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INTRODUCTION 
Background of the Complaint 


This investigation was initiated as a result of a complaint brought to our attention by the legal 
counsel of a union, on behalf of one of its members (the complainant). The complaint involved 
the Ministry of the Solicitor General, now the Ministry of the Solicitor General and Correctional 
Services (the Ministry). 


On December 17, 1991, at 7:30 a.m., the complainant was driving his car on a public highway 
when two Ontario Provincial Police (OPP) officers stopped him. The complainant was found 
in possession of narcotics and was taken into police custody. He was released at about 12:00 
noon after he had signed a document promising to appear in court on January 27, 1992. On the 
same day the complainant was taken into custody, one of the arresting officers advised the 
complainant’s supervisor of his arrest and the pending charges. An information was 
subsequently laid on January 9, 1992 -- 23 days after the complainant’s arrest. On February 26, 
1992, the complainant’s employment was terminated for conduct incompatible with his | 
employment. 


The complainant was of the view that his rights under the Freedom of Information and 
Protection of Privacy Act (the Act) had been violated and that the OPP officer’s disclosure of 
his arrest and the pending charges was not in accordance with the Act. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was section 37 of the Act applicable? 


(C) Was the OPP officer’s disclosure to the complainant’s employer in accordance 
with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an _ identifiable 
individual, including, 
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(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


We have determined that the information in question was the complainant’s name together with 
the circumstances of his arrest i.e. that the complainant had been found in possession of 
narcotics and that charges were going to be laid against him. It is our view that this information 
met the requirements of paragraph (h) of the definition of personal information in section 2(1) 
of the Act. 


Conclusion: The information in question was "personal information” as defined 
in section 2(1) of the Act. 


Issue B: | Was section 37 of the Act applicable? 


The Ministry acknowledged that on the day the complainant was arrested, one of the arresting 
OPP officers informed an engineering supervisor of the details of the complainant’s arrest and 
of the pending charges. This took place prior to the complainant signing the documents 
compelling a court attendance, and the laying of an information in court. 


The Ministry, however, was of the view that section 37 of the Act was applicable to the 
disclosure of the complainant’s personal information. Section 37 states: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


The Ministry submitted that: 


.. information relating to accused persons and their charges is available to the 
public. The personal information provided by PC [name of the police constable] 
could be found in a public record, e.g., a criminal court file. 


The Ministry stated: 


The OPP as a matter of general practice does not release information about accused 
persons prior to the laying of an information. While the Ministry acknowledges that the 
personal information was released in this instance before the information was laid, the 
Ministry submits that the information was soon to be available publicly. 


The Ministry further submitted that the disclosure accorded with the "Guidelines for the 


Peremptory Disclosure of Personal Information Held by Law Enforcement Agencies", issued by 
the Management Board of Cabinet initially in December 1990, then revised and redistributed in 
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August 1992. The revised guidelines state in part that where an information is laid or will be 
laid in a courthouse, the personal information contained in the information, such as the name, 
date of birth and address of the accused, may be disclosed. 


Under Section 37 of the Act, personal information that is maintained by an institution may be 
excluded from the application of Part III of the Act only if the personal information is 
maintained for the purpose of creating a record which is available to the general public. 


In this case, at the time of the disclosure of the complainant’s personal information by the OPP 
officer to the complainant’s employer, charges had not been laid; documents compelling a court 
appearance had not been signed; and an information had not been laid in court. 


It is thus our view that at the time of its disclosure, it could not be said that the information 
about the complainant’s arrest and the pending charges was being maintained by the OPP for the 
purpose of creating a record which was available to the general public. Therefore, section 37 
of the Act would not apply and the privacy provisions of Part III would not be excluded. 


With respect to the guidelines issued by Management Board, we wish to take a narrower 

interpretation than the view expressed in the guidelines that law enforcement agencies may 

disclose personal information about an accused before an information is laid, on the basis that 

the information will be available to the general public. 

Conclusion: Section 37 of the Act did not apply to the personal information disclosed by the 
OPP officer to the complainant’s employer. 

Issue C: Did the OPP officer disclose personal information to the complainant’s 


employer, in accordance with section 42 of the Act? 


Under the Act, an institution may not disclose personal information in its custody or under its 
control except in the specific circumstances outlined in section 42. 


The Ministry submitted that the OPP officer’s disclosure of the complainant’s arrest and the 
pending charges was in accordance with section 42(a) which states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(a) in accordance with Part II; 


As further support of this view, the Ministry cited a passage from the Freedom of Information 
and Protection of Privacy Manual produced by Management Board Secretariat which states: 
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Subsection 42(a) permits an institution to disclose personal information in 
circumstances where such a disclosure would be permitted under section 21 of the 
Act, even though the institution has not received an access request. This 
subsection should be read in conjunction with subsection 63(1) which permits a 
head to disclose information even though an access request has not been received. 


In past compliance investigations, we have held the view that the section 42(a) exception to the 
section 42 prohibition against disclosure of personal information only applies in the context of 
a request by an individual, made under Part II of the Act, for personal information relating to 
another individual. Given that section 63(1) of the Act does not refer specifically to “personal 
information", and bearing in mind that one of the purposes of the Act as set out in section 1(b) 
is to protect the privacy of individuals with respect to personal information, it is our view that 
section 63(1) should be interpreted narrowly. 


Nonetheless, we have examined section 63(1) in the circumstances of this case. In our view, 
even assuming that section 63(1) permits a head to disclose information where an access request 
has not been received, the disclosure in this specific case would not have been in accordance 
with section 42(a) of the Act. 


The Ministry submitted that because the disclosure was not an unjustified invasion of personal 
privacy since the information was soon to be made public and because there were also health and 
.safety concerns, the disclosure was in accordance with sections 21(1)(c), 21(1)(f) and 21(2)(b) 
of Part II of the Act. 

It is our view that the sections cited by the Ministry in support of its position would not have 
applied. However, Section 21(3) of the Act would have been relevant to the disclosure of the 
complainant’s arrest and of the pending charges. 

Section 21(3) of the Act states that: 


(3) A disclosure of personal information is presumed to constitute an 
unjustified. invasion of personal privacy where the personal information, 


(a) was compiled and is identifiable as part of an 
investigation into a possible violation of law.... 


Section 28(1) of the Act provides that: 
(1) Before a head grants a request for access to a record, 
(b) that is personal information that the head has reason to believe 


might constitute an unjustified invasion of personal privacy for the 
purposes of clause 21(1)(f), 


[IPC Investigation 192-66P/ June 11, 1993] 


Sie 


the head shall give written notice in accordance with subsection (2) to the 
person to whom the information relates. 


In this case, no notice as required under section 28(1)(b) was given to the complainant. 
Therefore, the disclosure of the complainant’s arrest and the pending charges would not have 
been in accordance with Part II of the Act, and consequently, would not have been in accordance 
with section 42(a). 


We have also examined the other provisions of section 42 of the Act and have determined that 
none of the provisions applied to the circumstances of this case. 


Conclusion: The disclosure by the OPP officer of the complainant’s arrest and the pending 
charges to his employer was not in accordance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 
e The information in question was "personal information" as defined in section 2(1) of the 
Act. 


8 Section 37 of the Act did not apply to the personal information disclosed by the OPP 
: officer to the complainant’s employer. 


* The disclosure by the OPP officer of the complainant’s arrest and pending charges to his 
employer was not in accordance with section 42 of the Act. 


RECOMMENDATION 


We recommend that the Ministry take steps to ensure that in future, disclosures of personal 
information by the OPP are in accordance with the provisions of the Act as interpreted in this 
investigation. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: June 11, 1993 
Ann Cavoukian, Ph.D Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint brought to our attention by the 
complainant’s legal counsel (Counsel), concerning the social services department of a regional 
municipality (the Municipality). 


In 1992, the complainant was successful in a rent review application to the Ministry of Housing. 
As a result, an order was made for the complainant’s landlord to pay the rent rebate directly to 
the complainant. The complainant was receiving welfare benefits at the time, and the 
Municipality was in the process of determining the portion of the rent rebate due to it under the 
General Welfare Assistance Act. 


The landlord paid the rent rebate to the Municipality, instead of to the complainant. As a result, 
the complainant, through her Counsel, initiated legal action against the landlord. The action 
resulted in a judgement that the landlord was to pay the monies directly to the complainant. 


The complaint centres on the Municipality’s disclosure of two letters dated August 13 and 
August 20, 1993, addressed to the complainant, by copying the complainant’s landlord and his 
~ agent. The subject of the letters concerned the amount of rent rebate that the complainant would 
have to repay to the Municipality. 


Counsel contends that in addition: a) the Municipality disclosed details of the complainant’s 
entitlement to the rent rebate to an Alderman, and b) that the Municipality’s Income Maintenance 
Supervisor, author of the two letters at issue, telephoned Counsel, on behalf of the landlord, in 
connection with a judgement against the landlord. 

Counsel maintains that the question of entitlement is a matter between the complainant and the 


Municipality; not a subject for disclosure to third parties. Counsel states that such an invasion 
of privacy is commonly experienced by social assistance recipients such as the complainant. 


Issues Arising from the investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information” as defined in section 2(1) 
of the Municipal Freedom of Information and Protection of Privacy Act (the Act). 


(B) Did the Municipality disclose the personal information to the landlord and his 
agent in accordance with section 32 of the Act? 


(C) Did the Municipality disclose personal information to an Alderman? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, (emphasis added) 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


_ The two letters to the complainant which were copied to the landlord and his agent indicated the 
portion of the rent rebate to be repayed to the Municipality by the complainant. 


It is our view that this information met the requirements of paragraphs (b) and (h) of the 
definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 2(1) 
of the Act. 


Issue B: Did the Municipality disclose the personal information to the landlord and his 
agent in accordance with section 32 of the Act? 


The Municipality’s Position 


The Municipality maintained that copies of the letters at issue were not mailed to the landlord 
and his agent, and that only the letter dated August 20, 1993, had contained the cc’s to the 
landlord and his agent. According to the Municipality, the complainant met with the Supervisor 
who gave her a letter detailing the portion of the rebate that was reimbursable to the Region. 
However, they did not specify which letter. According to the Municipality, the complainant 
indicated she wanted this information conveyed to her landlord and landlord’s agent in order to 
keep the transaction simple, so that the landlord could pay both herself and the Municipality the 
amounts owing them. The Supervisor included the cc’s on the letter so that the complainant had 
the option of delivering the letters herself. 


However, when we called the Supervisor, he informed us that he himself had added the cc’s to 
the August 13 letter. 
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Counsel’s Position 


Counsel provided us with copies of the two letters. Both contained cc’s to the landlord and the 
agent, but on the August 13 letter, the cc’s were in a different type from the main text. This 
would appear to confirm the Supervisor’s statement above. Z 


Counsel advised that instead of complying with the Rent Rebate Order, the landlord attended the 
offices of the Municipality and urged them to accept the rent rebate as he did not want to pay 
the complainant directly. The Municipality accepted the payment. 


Counsel stated that the usual method for recovering overpayments is to permit the welfare 
recipient to receive payment from a third party and then deduct any overpayment incrementally 
from the recipient’s future benefits. We were advised that for the Municipality to accept a 
payment from a third party, is most unusual. As the landlord had not strictly complied with the 
Order to pay the rent rebate to the complainant, she commenced garnishment proceedings against 
the landlord to have his bank account seized. 


Counsel maintained that the August 13 letter was mailed to the complainant, and that the letter 
indicated it was copied to the landlord and his agent. The complainant told him that she had not 
requested the information be conveyed to her landlord. Counsel explained that there was no 
reason why the landlord would need the information in these letters, since the amount owing to 
the complainant was clearly stated on the Rent Review Order, and was to be paid directly to the 
complainant. At the time the August 13 letter was received by the complainant, she was not 
even aware of her landlord’s involvement with the Municipality, and thus could not have 
consented to the disclosure of the letter to the landlord. 


Counsel suggested that the complainant felt she had to deliver the letter in order to receive her 
portion of the rent rebate. To substantiate this claim, Counsel provided us with documentation 
to show that the complainant had received the rebate the day after she delivered the letter. 


The complainant told Counsel that she personally delivered the August 20 letter to the landlord, 
because she believed that the August 13 letter had already been disclosed to the landlord and his 
agent, and because she was told her portion of the rent rebate would be processed faster if she 
delivered the letter herself. 


We contacted the landlord concerning these letters. He responded that he could not remember 
whether or not he had received them. 


Conclusion: We were unable to determine whether the Municipality had disclosed the 
Complainant’s personal information to the landlord and his agent. 
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Issue C: Did the Municipality disclose personal information to the Alderman? 


The Municipality maintained that there had been no disclosure of any personal information 
relating to the complainant’s case. They confirmed that the Alderman had called the Manager 
of Income Maintenance to discuss the complainant’s entitlement to the rebate, and the 
Municipality’s legal entitlement to recover a portion of it. The Municipality stated that the 
Alderman had been well aware of the details concerning the complainant, before contacting 
them. However, the information they provided the Alderman was generic rather than specific, 
based on the statutory rights and general practices of the Municipality: the complainant’s 
personal information was said not to have been disclosed. 


The Alderman confirmed that she had called the Municipality on the matter of the complainant’s 
entitlement to the rent rebate. She called in response to concerns raised by the landlord’s 
daughter. We were unable to determine from the Alderman whether specific details of the 
complainant’s case had been disclosed to her by the Municipality. The Alderman confirmed that 
she had been familiar with the complainant’s case before calling the Municipality. 


While counsel believed that the complainant’s personal information had been disclosed to the 
Alderman by the Municipality, we found no evidence to confirm whether or not such disclosure 
had occurred. 


Conclusion: We were unable to determine whether the Municipality had disclosed personal 
information to an Alderman. 


Other Matters 


Counsel was of the opinion that the Income Maintenance Supervisor appeared to be assisting the 
landlord in a tenancy matter between the complainant and her landlord, by appealing to Counsel 
for clarification of a garnishment against the landlord, so as to advise the landlord. 


Our concern here is with the possible use of personal information in the Supervisor’s possession. 


The Municipality advised that the Supervisor’s reason for contacting Counsel was to convey 
information pertinent to the complainant’s case, and of benefit to Counsel and to his client: that 
the Municipality was returning all monies paid to them by the landlord, so that the landlord 
could then immediately re-issue payment correctly to the complainant. 


Counsel’s response was that monies did not have to be returned by the Municipality to the 
landlord as a condition precedent of the complainant receiving her monies from the court. Also, 
the landlord did not have to re-issue payment to the complainant since the court had already 
seized the monies from the landlord’s bank account. 


Absent sufficient evidence, we were unable to make any findings regarding the subject of the 
conversation between the Counsel and the Supervisor. 
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We make no recommendations in this report. While we were unable to conclude that the 
Municipality had disclosed the complainant’s personal information, we were nonetheless 
concerned with the degree of involvement between the Municipality, the landlord, and his agent, 
in a matter involving the complainant’s personal information. 


The Municipality has advised that they are discussing a new internal procedure. whereby any 
letters requested by social assistance recipients, containing personal information such as details 
of entitlement, will in future be addressed, "To Whom it May Concern". The information may 
then be disclosed at the recipient’s discretion, without involving the Municipality. 


We do, however, wish to remind the Municipality that due care should be exercised at all times 


to ensure the protection of personal privacy, when considering disclosures of personal 
information to third parties. 


SUMMARY OF CONCLUSIONS 


0 The information in question was personal information as defined in section 2(1) of the 
Act. 
0 We were unable to determine whether the Municipality had disclosed the Complainant’s 


personal information to the landlord and his agent. 


0 We were unable to determine whether the Municipality had disclosed the complainant’s 
personal information to an Alderman. 


Onginal signed by: June 15, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 


[IPC Investigation I92-74M/June 15, 1993] 


Information and Privacy Publications 
Commissioner/Ontario 

Commissaire a l'information ; 

et a la protection de la vie privée/Ontario 


PT | 
a FP) Z. ON 
eh 


he 


INVESTIGATION REPORT 


INVESTIGATION 193-002P 


’ THE MINISTRY OF THE ENVIRONMENT AND ENERGY 


80 Bloor Street West, 80, rue Bloor ouest 416-326-3333 
a Suite 1700, Bureau 1700 1-800-387-0073 
Toronto, Ontario Toronto (Ontario) 


F 5/€¢: -325- 
ON en Lewes ax/Téléc: 416-325-9195 


Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontario, Sth Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toil free in 
Ontano 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de l'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1NB8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d'interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésoner de |’Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the 
Environment, now the Ministry of the Environment and Energy (the Ministry). 


The complainant was concerned that the Ministry had disclosed his personal information without 


his consent, contrary to the Freedom of Information and Protection of Privacy Act (the Act). 
More specifically, he was concerned that the Ministry had disclosed facts about his subdivision 


in Amabel Township to a lawyer in Calgary. According to the complainant, a Planning 
Evaluator of the Ministry’s Approval and Planning Unit had disclosed his personal information 
in four letters. These letters were: 


(1) Dated October 18, 1990, addressed to a named individual at the Owen Sound District 
‘Office regarding “storm drainage and site disturbance concerns". 


(2) Dated December 5, 1990, addressed to the complainant, regarding "drainage works". 


(3) Dated January 31, 1991, addressed to a named individual at the Bruce/Grey/Owen Sound 
Health Unit, regarding "surface water drainage proposal". 


(4) Dated March 14, 1991, addressed to a named individual at the Plans Administration 
Branch, Ministry of Municipal Affairs, regarding "réview of storm water management 
plan”. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? 


(B) If the answer to the above question is "yes", was the personal information 
disclosed in accordance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 
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Under section 2(1) of the Act "personal information" means "recorded information about. an 
identifiable individual." 


There is a clear differentiation between individuals who are acting in a personal capacity and 
individuals who are acting on behalf of an incorporated body. The Information and Privacy 
Commissioner has held in Orders 80, 113 and P-257 that the name of an individual, when acting 
on behalf of an incorporated body, is corporate information -- not personal information. 


The Ministry’s Freedom of Information and Protection of Privacy Co-ordinator (the Co- 
ordinator) provided our office with copies of the letters at issue, but would not confirm or deny 
that these records had been disclosed. According to the Ministry, the complainant’s name was 
not "personal information" as it is defined in the Act because the subdivision application records 
the registered owner as "Chiefs’ Park Limited", with the complainant as the President. 
According to the Co-ordinator, correspondence was received from the complainant on Chiefs’ 
Park Limited letterhead indicating that the complainant was representing that company. The 
Ministry also acknowledged that it mentioned the complainant’s name and address in one of the 
letters. This particular letter did not refer to the complainant in his corporate capacity. Further, 
the letters dated January 31, 1991, and March 14, 1991, referred to the complainant and not 
Chiefs’ Park Limited as the owner of the subdivision. 


Legal Counsel for the complainant submitted that since the complainant is one and the same 
person as his corporation Chiefs’ Park Limited, all of the information contained in the letters 
in question was personal to the complainant. Legal Counsel also submitted that Orders 80 and 
113 were only authority for the fact that if someone had asked for the name of the President of 
Chiefs’ Parks Limited, the complainant’s name could be disclosed. Counsel further submitted 
that Order P-257 did not apply to this investigation, and that in his view, the term "person" in 
the Act should include "corporation", making reference to the Interpretation Act. 


The use of the term "individual" in the Act makes it clear that the protection provided with 
respect to the privacy of personal information relates only to natural persons. Had the 
legislature intended an "identifiable individual" to include a corporation, it could and would have 
used the appropriate language to make this clear. The types of information enumerated under 
section 2(1) of the Act as "personal information" when read in entirety, lend further support to 
the conclusion that "personal information" relates only to natural persons. 


There may be cases where the information about a business may be so closely connected to 
information about an individual that the information may qualify as being "personal" for 
purposes of the Act. We acknowledge that in the correspondence in question, the complainant 
was identified personally rather than in his corporate capacity, and that the corporation was 
owned by the complainant. However, these letters contained information relating to the 
subdivision owned by Chiefs’ Park Limited, and the correspondence had been written on 
corporate letterhead, indicating that the complainant was representing the company. 
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After carefully considering these facts, it is our view that the information contained in the letters 
at issue did not constitute the complainant’s "personal information". These letters contained 
information relating to the subdivision owned by Chiefs’ Park Limited. Accordingly, Part III 
of the Act did not apply in the circumstances of this complaint. 


Conclusion: The information in question was not "personal information" as defined by section 
2(1) of the Act. 


As we did not find the information to be personal information under the Act, issue B was not 
addressed. 


SUMMARY OF CONCLUSIONS 


® The information in question was not "personal information" as defined by section 2(1) 
of the Act. 


RECOMMENDATION 


We are concerned that the Ministry’s correspondence erroneously referred to the complainant 
(instead of the corporation) as the owner of the subdivision. Therefore, we recommend that the 
Ministry review its practices and take the necessary precautions to ensure that such errors do not 
occur in future. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signd by: July 20, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontario, 5th Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toil free in 
Ontario 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de Il'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1N8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d'interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésoner de l'Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a Municipality’s Ambulance 
Service. The complainant is an employee of the Ambulance Service. 


The complainant attended an ambulance call, which caused him to experience "critical incident" 
stress. As a result of this, the complainant used the services of the Ambulance Service’s staff 
psychologist (the Psychologist). The complainant then filed a claim with the Workers’ 
Compensation Board (the WCB). 


The complainant stated that after the claim had been filed, his supervisor (the Supervisor) at the 
Ambulance Service had collected and then disclosed his personal information to the WCB, 


contrary to the Municipal Freedom of Information and Protection of Privacy Act (the Act). 
According to the complainant, although the Psychologist had assured him of confidentiality, the 


Psychologist had also disclosed his personal information to the Supervisor and the WCB, 
contrary to the Act. 


The complainant also submitted that his personal information was presently accessible to all 
management staff. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? 


(B) Was the collection of personal information by the Supervisor in accordance with 
section 28(2) of the Act? 


(C) Was the disclosure of personal information by the Supervisor to the WCB in 
accordance with section 32 of the Act? 


(D) Did the Psychologist disclose personal information to the Supervisor? If yes, 


(E) Was this disclosure by the Psychologist to the Supervisor in accordance with 
section 32 of the Act? 


(F) Was the disclosure of personal information by the Psychologist to the WCB in 
accordance with section 32 of the Act? 
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(G) | Were reasonable measures in place to prevent unauthorized access to personal 
information in accordance with section 3(1) of Regulation 823 under the Act, as 
amended by Regulation 395/91? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 2(1) 
of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual... 


(g) the views or opinions of another individual about the individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual... 


The complainant provided us with a number of documents containing his personal information. 
These documents included two WCB memoranda to file, one containing the complainant’s 
medical information, and the other containing the Supervisor’s opinion of the complainant, as 
well as other information relating to the complainant. The documents also included telephone 
notes made by the Supervisor with details about the complainant’s contact with the Psychologist, 
and two internal memoranda containing information related to the complainant’s WCB claim. 


It is our view that the information contained in these documents met the requirements in 
paragraphs (b), (g) and (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Was the collection of personal information by the Supervisor in accordance with 
section 28(2) of the Act? 


Section 28(2) states: 
No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 


enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 
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The complainant submitted that the Supervisor did not have the authority to collect his personal 
information. The complainant provided copies of telephone notes and memoranda. One 
memorandum indicated that the Supervisor had conducted an investigation relating to the 
complainant’s WCB claim in which he had spoken to the police on the scene of the ambulance 
call and to detectives investigating the scene, and to "others who have spoken to [the 
complainant] concerning his experience ...". 


The Ambulance Service submitted that the Supervisor had the authority to collect information 
about the complainant’s claim for WCB benefits, in order to satisfy the WCB and to provide it 
with comprehensive information. According to the Ambulance Service, any time a WCB claim 
is under dispute, the Supervisor has an obligation to collect appropriate information to forward 
to the WCB in accordance with its Personnel Corporate Workers’ Compensation Manual (the 
Manual) which includes a section on Accident and Reporting. The Ambulance Service submitted 
that since the Supervisor had a duty to provide the WCB with appropriate information about the 
claim, the Supervisor’s collection of personal information was necessary to the proper 
administration of the lawfully authorized activity of processing the WCB claim. 


The complainant subsequently provided us with documentation indicating that the Ambulance 
Service has a Health and Safety Unit (the Unit) which includes a Workers’ Compensation and 
Rehabilitation division. This division is responsible for dealing with employee occupational 
injury and illness which involves: "The administration of WCB accident claims; Signing all 
compensation forms ensuring proper accuracy and completion; Reviewing all compensation 
claims ensuring compliance as required by the Workers’ Compensation Act including the 
submission of required reports and information". 


We examined both the Manual and the information submitted by the complainant. In our view, 
the processing of an employee’s WCB claim is a lawfully authorized activity. As part of this 
process, the Ambulance Service had an obligation to ensure that the WCB had all the necessary 
information with respect to the processing of the claim. It was necessary, therefore, for the 
Supervisor to collect the complainant’s personal information, relevant to the processing of the 
claim, for the purpose of providing the information to the Unit. The Unit was then responsible 
for forwarding it to the WCB on behalf of the employer. In our view the Supervisor’s collection 
of the complainant’s personal information, relevant to the processing of the WCB claim, was 
necessary for the proper adminstration of a lawfully authorized activity. 


_Conclusion: The collection of personal information was in accordance with section 
28(2) of the Act. 


Issue C: Was the disclosure of personal information by the Supervisor to the WCB in > 
accordance with section 32 of the Act? 


Section 32(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 
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(e) for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or a treaty; 


One of the WCB memos to file which the complainant had provided to us, outlined a telephone 
conversation between a WCB employee and’ the Supervisor. The memorandum detailed the 
Supervisor’s opinion of the cause of the critical incident stress and his views as to the 
complainant’s ability to deal with the matter, as well as his work relationship with the 
complainant. 


The Ambulance Service advised that it relied upon section 32(e) of the Act for this disclosure 
and referred us to section 133(1) of the Workers’ Compensation Act (the WCA). This section 
states in part that an employer shall: "in any case furnish such further details and particulars 
respecting any accident or claim to compensation as the Board may require." The Ambulance 
Service submitted that the Supervisor’s disclosure was to provide further details and particulars 
to the WCB. This was especially important since the claim was under dispute -- the Supervisor 
had an obligation to forward appropriate information to the WCB. 


The complainant stated that the Supervisor should not have disclosed his personal information 
directly to the WCB, but rather, to the Unit which would then have contacted the WCB. In 
response to this, the Ambulance Service submitted that both the Unit and the Supervisor share 
the responsibility of ensuring that the WCB is informed of all the facts relevant toa claim. The 
Ambulance Service stated that, in communicating directly with the WCB, the Supervisor fulfilled 
his responsibility of providing the relevant facts to the WCB, in a timely manner. Further, the 
existence of the Unit was not intended to, nor relieves the Supervisor of the responsibilities 
outlined in the Manual or the Corporate Health and Safety Manual, the WCA, or the 
Occupational Health and Safety Act. The Ambulance Service stated that while the Unit does 
have the responsibility for day-to-day claims management and for communicating with the WCB, 
this does not override the Supervisor’s responsibilities for claims management which include 
keeping the Unit informed and communicating with the WCB. 


In our view, section 133(1) of the WCA requires an employer to provide the WCB with any 
information respecting a claim which the WCB may require. Since it is the responsibility of the 
Unit to administer WCB accident claims, the Unit would be acting as the employer. As such, 
any disclosure of personal information by the Unit to the WCB would be in accordance with 
section 133(1) of the WCA and thus, would be in accordance with section 32(e) of the Act. 
However, in this case, the Supervisor disclosed personal information to the WCB directly and 
not to the Unit, which was responsible for communicating with the WCB and administering the 
complainant’s claim. The Ambulance Service has submitted that the Supervisor is equally 
responsible for the administration of WCB claims which includes communicating with the WCB 
directly. After carefully reviewing all of the information provided by the Ambulance Service 
in this regard, it is our view that the information does not demonstrate that the Supervisor was 
equally responsible for the administration of WCB claims and direct communications with the 
WCB. There appears to be no written policy available to all employees which clearly states that 
both share equal responsibility. 
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Further, on one occasion where the Supervisor communicated information to the Unit, his 
memorandum stated, "I would welcome [the complainant’s] Adjudicator to telephone me or meet 
with me to discuss this further or answer any questions she/he may have." In our view, this 
demonstrates that the Supervisor was aware of the Unit’s role and responsibility to communicate 
with the WCB regarding the complainant’s claim. 


Therefore, we remain of the view that the Unit was responsible for administering the WCB 
claim and communicating with the WCB. Since the Unit was responsible for acting on behalf 
of the employer, the disclosure of the personal information by the Supervisor to the WCB was 
not made in accordance with section 133(1) of the WCA. Therefore, the disclosure was not in 
accordance with section 32(e) of the Act. 


We have examined the other provisions of section 32 which permit disclosure and have 
determined that none were applicable to the disclosure made by the Supervisor to the WCB. 


Conclusion: The disclosure by the Supervisor to the WCB of the complainant’s 
personal information.was not in accordance with section 32 of the Act. 


Issue D: Did the Psychologist disclose personal information to the Supervisor? 


According to the complainant, the Psychologist disclosed his personal information to the 
Supervisor on at least two occasions. As evidence of these disclosures, he provided us with the 
following: 


Disclosure 1: A WCB worker’s file note stating that the Supervisor had advised her that "It was 
indicated by [the Psychologist] that the worker’s problems might have been triggered by 
something else concerning his personal life." 


The complainant also referred to the Supervisor’s internal memorandum wherein he indicated 
that he had conducted an investigation relating to the complainant’s WCB claim, during which 
he had contacted "others who have spoken to [the complainant] concerning his experience and 
I am not satisfied that [the complainant] has experienced critical incident stress." The 
complainant informed us that he had spoken to no one other than the Psychologist about the 
incident. The complainant questioned how the Supervisor could have made a finding of this 
nature without any input from the Psychologist. In his comments on the draft report, the 
complainant provided further information to support his view that there had been a disclosure. 


Disclosure 2: A copy of a telephone note made by the Supervisor during a conversation with 
the Psychologist that stated: "Spoke to [the Psychologist] - said he’d spoken to [the complainant] 
- didn’t want to meet him - seeing his own Dr. - went on for about an hour re how DAS had 
errored in ensure contact = him". 


The Ambulance Service has advised that the Psychologist maintained that he had not disclosed 
any personal information to the Supervisor. 
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We have examined the documents provided by the complainant, including the information 
provided in response to the draft report. With regard to the first disclosure, it remains our view 
that the documents do not establish conclusively that the Psychologist disclosed the specific 
personal information about the complainant’s critical incident stress to the Supervisor. 
Therefore, we remain unable to conclude that the first disclosure had occurred. 


However, with regard to the second disclosure, it is our view that the telephone note did 
establish that the Psychologist disclosed to the Supervisor, the fact that he had made contact with 
the complainant and the subject matter of that contact regarding, for example, the fact that the 
complainant was seeing his own doctor. Therefore, in our view, we can conclude that the 
second disclosure did occur. 


Conclusion: The Psychologist disclosed the complainant’s personal information to the 
Supervisor. 


Issue E: Was this disclosure by the Psychologist to the Supervisor in accordance with 
section 32 of the Act? 


The Ambulance Service stated that it relied upon section 32(d) of the Act for the disclosure. 
Section 32(d) of the Act states: 


An institution shall not disclose personal information in its custody or under its — 
control except, 


(d) if the disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and if the 
disclosure is necessary and proper in the discharge of the institution’s 
functions. 


The Ambulance Service stated that the Supervisor needed the complainant’s personal information 
in the performance of his duties. The Ambulance Service submitted that the Supervisor was 
required to both ensure the well-being of the employee by ensuring that the Psychologist and the 
complainant had made contact, and to provide the WCB with comprehensive information 
regarding the WCB claim. In its comments on the draft report, the Ambulance Service 
submitted that a significant factor in the WCB’s decision to grant or deny a claim is whether or 
not an individual has sought medical attention, or if there is a delay in seeking medical attention. 
This is also relevant to a supervisor’s decision to question a WCB claim or to appeal a decision. 
Therefore, based upon this information, the Ambulance Service submitted that the Supervisor 
needed to know of any contact between the Psychologist and the complainant as part of his 
responsibility for investigating the WCB claim and ensuring the well-being of the employee. 
Accordingly, the disclosure by the Psychologist to the Supervisor was a disclosure to an 
employee who needed the information in the performance of his duties, and it was necessary and 
proper in the discharge of the institution’s functions. 
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It is our view that the investigation and processing of employees’ WCB claims are administrative 
functions of the institution. The Ambulance Service submitted that the personal information in 
question was relevant to a supervisor’s investigation of a WCB claim since it might affect his 
decision to question a claim or to appeal a decision. In this case, the Supervisor placed a 
question on the complainant’s claim with the Unit before he called the Psychologist regarding 
any contact he had had with the complainant. Thus, in this case, it is our view that the 
information from the Psychologist was not necessary for the Supervisor to place a question on 
the complainant’s claim with the Unit. In addition, it is our view that the disclosure by the 
Psychologist of his contact with the complainant, and any details relating to that contact, was 
not necessary and proper for the purpose of processing the WCB claim. Therefore, it is our 
view that the disclosure was not in accordance with section 32(d) of the Act. 


In our draft report we stated that we had examined the application of section 32(c) of the Act 
to the disclosure. Section 32(c) permits the disclosure of personal information "for the purpose 
for which it was obtained or compiled or for a consistent purpose". We stated that in our view, 
one of the purposes for the complainant’s personal information being obtained by the 
Psychologist during the course of assisting him, would have reasonably been to ensure the well- 
being of the complainant as an employee. It was thus our view that the Psychologist’s disclosure 
of the fact that he and the complainant had made contact was, in part, to reassure the Supervisor 
that contact had been made with the employee and that he was in fact receiving assistance from 
the Psychologist. The Supervisor, as the complainant’s supervisory officer, was responsible for 
the well-being of the employee, in the workplace. Therefore, it was our view that the disclosure 
to the Supervisor by the Psychologist of his contact with the complainant (but not the details of 
the contact) would have been in accordance with section 32(c) of the Act. 


Since then, however, documentation provided by the complainant indicates that it is not the 
Supervisor but the Unit that co-ordinates all matters pertaining to Health and Safety in the 
workplace; specifically, the Workers’ Compensation and Rehabilitation division has the 
responsibility for dealing with employee occupational injury and illness. 


In addition, the complainant provided information regarding the confidentiality requirements for 
the Ambulance Service’s Critical Incident Stress Debriefing Team (the Team) of which the 
Psychologist is a member. This information indicates that emphasis is given to staff being 
"entitled to strict and complete confidentiality including anonymity of person and events..." in 
most situations where a member of the Team has been contacted. The complainant also provided 
a copy of a statement later made by the Psychologist regarding his contact with the complainant, 
which reads in part, "At our first meeting I did inform him that he need not disclose the fact that 
he had met with me. No one needed to know that we had even met. I indicated the Department 
fully respects the concept of client confidentiality." 


The Ambulance Service provided information from the Corporate Health and Safety Manual 
outlining that a competent supervisor must "take every precaution reasonable in the 
circumstances for the protection of a worker", and a policy which states: "all levels of 
management have, as a primary responsibility, the safety and personal well-being of employees 
directly below them". The Ambulance Service maintained that all supervisors have a 
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responsibility to ensure the personal well-being of their employees, and a responsibility to the 
public to ensure that employees are able to perform their duties. The Ambulance Service stated 
that it is not feasible in practice, or justifiable under the WCA or the Occupational Health and 
Safety Act, for the Unit to coordinate all matters pertaining to Health and Safety in the 
workplace, or to have sole responsibility for these matters with employees. 


We have carefully reviewed all of the information provided by both parties. We remain of the 
view that one of the purposes for the complainant’s personal information being obtained by the 
Psychologist during the course of assisting him would have reasonably been to ensure the well- 
being of the complainant as an employee. We acknowledge that supervisors do have some 
responsibility for the health and safety of their employees in addition to the Unit’s 
responsibilities... However, in our view, when the Ambulance Service established its Critical 
Incident Stress Debriefing Team, employee health and safety would have been a factor 
considered in its development. The policy of confidentiality of contact with the Team would 
have been drafted with the well-being of the employees who used the services of the Team in 
mind. Thus in our view, the Team has the primary responsibility for ensuring the well-being 
of the employee and as part of that responsibility, Team members are required to abide by the 
Ambulance Service’s confidentiality policy. Thus we regard the disclosure by the Psychologist 
of his contact with the complainant, which was contrary to this policy, not to have been for the 
well-being of the employee. 


Given the Ambulance Service’s policy of strict confidentiality regarding staff contact with the 
Team, it is our view that it was inappropriate for the Supervisor to have been informed by the 
Psychologist that contact had been made between the Psychologist and the complainant. Since 
it is our view that the Psychologist’s disclosure of his contact with the complainant to the 
Supervisor was not for the purpose of ensuring the well-being of the complainant as an 
employee, we do not consider the Psychologist’s disclosure to have been made for one of the 
purposes for which he had obtained the information. Therefore, it was not in accordance with 
section 32(c) of the Act. It is also our view that no other provisions in section 32 applied to this 
disclosure. 


Conclusion: The Psychologist’s disclosure to the Supervisor was not in accordance 
with section 32 of the Act. 


Issue F: Was the disclosure of personal information by the Psychologist to the WCB in 
accordance with section 32 of the Act? 


The complainant provided a statement from his WCB claim file which showed that the 
Psychologist had been contacted by the WCB to obtain a diagnosis and authorization for the 
complainant to be off work. The Psychologist told the WCB that he had met with the 
complainant and would be seeing him on a regular basis, but would not comment on a diagnosis 
or authorization for the complainant to be off work. 
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The Ambulance Service has stated that if there had in fact been a disclosure, it would have been 
in accordance with section 32(e) of the Act. Section 32(e) states that an institution shall not 
disclose personal information in its custody or under its control except for the purpose of 
complying with an Act of the Legislature or an Act of Parliament. The Ambulance Service had 
relied upon section 133(1) of the WCA, for the same reasons as outlined in Issue C. 


It is our view that the WCA requires an employer to provide the WCB with any information 
respecting a claim which the WCB may require. The Psychologist, who was an employee of 
the Ambulance Service, was contacted by the WCB for further details and particulars respecting 
the complainant’s claim. Since the WCA requires an employer to provide the WCB with any 
information it may require, it is our view that the Psychologist disclosed the complainant’s 
personal information in accordance with section 32(e) of the Act. 


Conclusion: The Psychologist’s disclosure to the WCB was in accordance with section 
32(e) of the Act. 


Issue G: Were reasonable measures in place to prevent unauthorized access to personal 
information in accordance with section 3(1) of Regulation 823 under the Act, as 
amended by Regulation 395/91? 


Section 3(1) of Regulation 823, as amended by Regulation 395/91, states: 


Every head shall ensure that reasonable measures to prevent unauthorized access 
to the records in his or her institution are defined, documented and put in place, 
taking into account the nature of the records to be protected. 


It is our understanding that during the day, supervisors may record various daily incidents in 
notebooks or logs. According to the complainant, the supervisors’ logs are located in the 
management office and are accessible by all management staff. In his submissions to our draft, 
the complainant maintained that this also applies to supervisors’ telephone notes. The 
complainant advised us that his personal information relating to the WCB claim had been 
"leaked" to Ambulance Service staff through the Supervisor’s telephone notes. He also 
submitted that another staff member had read the Supervisor’s telephone notes containing his 
personal information, and had informed him of the contents of these notes. 


The Ambulance Service has advised that the logs are kept locked in wooden boxes located in the 
basement of the area office. When supervisors are on the road, these logs are kept with them 
at all times. At the end of the day when supervisors return to the office, the logs are returned 
to the boxes; supervisors have a key to their own boxes. The Area Manager also has a key to 
each individual box but uses the key only in emergencies when the supervisor is away from the 
office or on vacation. The Ambulance Service also advised that supervisors do not routinely 
keep telephone notes separately from the logs. In this case, the Supervisor felt that separate 
telephone notes were necessary. The Ambulance Service advised that supervisors’ telephone 
notes are kept with the logs in the locked boxes, or are locked in the supervisors’ offices during 
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the day. The Ambulance Service has thus maintained that any telephone notes made by 
supervisors are kept in the same secure fashion as the logs, and that reasonable measures are in 
place to prevent unauthorized access to them. 


The complainant submitted that there is no policy regarding the security of telephone notes. He 
stated that he learned of the Supervisor’s contact with the WCB from another staff member who 
had gained access to the Supervisor’s telephone notes while the notes were at the Supervisor’s 
desk. As evidence, the complainant provided a memorandum from his WCB claim file which 
notes that he contacted the WCB Adjudicator to ask about the Supervisor’s contact with the 
WCB. The complainant informed the WCB Adjudicator that he had learned about the 
Supervisor’s contact with the WCB from one of his co-workers. The complainant submitted that 
his co-worker could only have accessed this particular information through the telephone notes. 
Based upon this, the complainant submitted that reasonable measures were not in place to 
prevent unauthorized access to the telephone notes. 


We have carefully reviewed the information provided by the complainant. It is our view that 
the documents do not establish conclusively that there was unauthorized access to the 
Supervisor’s telephone notes. Further, while it appears in this instance that Ambulance Service 
staff may have become aware of the incident relating to the complainant’s WCB claim, we were 
unable to determine conclusively that this had resulted from unauthorized access to the log books 
and telephone notes. 


We have reviewed the procedures for the log books and telephone notes and it is our view that 
reasonable measures are in place to prevent unauthorized access while the logs and telephone 
notes are in the area office. However, section 3(1) of the Regulation requires that these 
measures be "defined" and "documented". 


In a previous investigation which also involved supervisors’ logs (in part), we found that the 
Ambulance Service’s Privacy Guidelines did not address the matter of supervisors’ logs and the 
measures in place to prevent their unauthorized access. _In this investigation, we noted that 
there were there are no guidelines as of yet, specifically addressing the matter of logs and 
telephone notes, and the measures in place to prevent their unauthorized access. 


Conclusion: Reasonable measures were in place to prevent unauthorized access to the 
personal information contained in the supervisors’ logs and the telephone 
notes. However, these measures have not been "defined" or 
"documented", as required by section 3(1) of Regulation 823 under the 
Act, as amended by Regulation 395/91. 


OTHER MATTERS 


The complainant also raised a concern that the personal information disclosed by the Supervisor 
to the WCB was incorrect. We would like to refer the complainant to section 36(2) of the Act 
which sets out the complainant’s right of correction to his personal information (see Appendix 
A for full text). 
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SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 

e The collection of personal information was in accordance with section 28(2) of the Act. 

e The disclosure by the Supervisor to the WCB of the complainant’s personal information 
was not in accordance with section 32 of the Act. 

e The Psychologist disclosed the complainant’s personal information to the Supervisor. 

e The Psychologist’s disclosure to the Supervisor was not in accordance with section 32 
of the Act. 

e The Psychologist’s disclosure to the WCB was in accordance with section 32(e) of the 
Act. 

e Reasonable measures were in place to prevent unauthorized access to the personal 
information contained in the supervisors’ logs and telephone notes. However, these 
measures have not been "defined" or "documented", as required by section 3(1) of 
Regulation 823 under the Act, as amended by Regulation 395/91. 

RECOMMENDATIONS 


We recommend that: 


i 


The Ambulance Service take steps to ensure that all staff are aware of the limited 
purposes for which the disclosure of personal information is permitted under section 32 
of the Act. 


If it is the Ambulance Service’s intent that supervisors should have equal responsibility 
as the Health and Safety Unit for the administration of WCB claims, including 
communicating directly with the WCB, then the Ambulance Service should clearly set 
this out in a written policy, and ensure that all staff are made aware of it. 


The Ambulance Service’s Privacy Guidelines should include information regarding the 


measures in place for the safe storage of supervisors’ logs and telephone notes, and 
access to them. 
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Within six months of receiving this report, the Ambulance Service should provide the Office of 
the Information and Privacy Commissioner/Ontario with proof of compliance with the above 
recommendations. 


Original signed by: September 30, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 


* KKK 
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APPENDIX A 
36. (1) Every individual has a right of access to, 


(a) any personal information about the individual contained in a 
personal information bank in the custody or under the control of 
an institution; and 


(b) any other personal information about the individual in the custody 
or under the control of an institution with respect to which the 
individual is able to provide sufficiently specific information to 
render it reasonably retrievable by the institution. 


(2) Every individual who is given access under subsection (1) to personal information is 
entitled to, 


(a) request correction of the personal information if the individual 
believes there is an error or omission; 


(b) require that a statement of disagreement be attached to the 
information reflecting any correction that was requested but not 
made; and 

(c) require that any person or body to whom the personal information 
has been disclosed within the year before the time a correction is 
requested or a statement of disagreement is required be notified of 
the correction or statement of disagreement. 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a Municipality’s Ambulance 
Service. 


The complainant is an employee of the Ambulance Service. While on duty he consulted with 
the staff psychologist (the Psychologist) regarding an ambulance call on May 14, 1992, which 
caused him to experience "critical incident" stress. The complainant then filed a claim with the 
Workers’ Compensation Board (the WCB). He subsequently requested access to his file 
regarding that particular ambulance call. During a review of his file he noticed that an exchange 
of communication had been documented between the Psychologist and his Supervisor regarding 
the ambulance call on May 14, 1992. It is the complainant’s view that his privacy was breached 
when his Supervisor consulted with the Psychologist and with a Union Representative about his 
treatment, diagnosis and follow-up interviews in connection with his workers’ compensation 
claim. 


The complainant was also concerned that the Ambulance Service had documented and filed his 
personal and confidential information, in a place that was accessible to other management staff. 
According to the complainant, these actions contravened the Municipal Freedom of Information 
and Protection of Privacy Act (the Act). 


Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


A. Was the information in question "personal information" as defined in section 2(1) 
of the Act? 
B. Was the disclosure of personal information by the Psychologist to the Supervisor 


in accordance with section 32 of the Act? 


OF Was the disclosure of personal information by the Supervisor to the Union 
Representative in accordance with section 32 of the Act? 


1B Were reasonable measures in place to prevent unauthorized access to personal 


information in accordance with section 3(1) of Regulation 823 under the Act, as 
amended by Regulation 395/91? 


{IPC Investigation 192-90M/October 4, 1993] 


oy] 
RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 2(1) 
of the Act? 


Section 2(1) of the Act states, in part: 


“personal information" means recorded information about an identifiable 
individual, including, . 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual .... 


(h) — the individual’s name where it appears with other personal information 
relating to the individual. 


The complainant provided us with a number of documents containing his personal information. 
These documents included one set of telephone notes made by the Supervisor regarding details 
about the complainant’s contact with the Psychologist; an internal memorandum containing 
information related to the complainant’s WCB claim, and a note written by the Union 
Representative containing details of discussions with the Supervisor about the WCB claim. 


It is our view that the information contained in these documents met the requirements of 
paragraphs (b) and (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in section 2(1) - 
of the Act. 


Issue B: Was the disclosure of personal information by the Psychologist to the Supervisor 
in accordance with section 32 of the Act? 


We have determined from the documents provided by the complainant that the Psychologist had 
disclosed to the Supervisor the fact that he had been in contact with the complainant about his 
WCB claim for critical incident stress. It is our view that these documents did not support the 
complainant’s view that the Psychologist had disclosed additional details about their meetings. 


In our draft report, we stated that we had examined the application of section 32(c) of the Act 
to the Psychologist’s disclosure of his contact with the complainant to the Supervisor. Section 
32(c) permits disclosure of personal information "for the purpose for which it was obtained or 
compiled or for a consistent purpose". We stated that in our view one of the purposes for the 
complainant’s personal information being obtained by the Psychologist during the course of 
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assisting him, would have reasonably been to ensure the well-being of the complainant as an 
employee. It was thus our view that the Psychologist’s disclosure of the fact that he and the 
complainant had made contact was, in part, to reassure the Supervisor that the employee had 
contacted him and was being assisted with respect to his critical incident stress. The Supervisor, 
as the complainant’s supervisory officer, was responsible for the well-being of the employee, 
in the workplace. Therefore, since the personal information could be said to have been disclosed 
for one of the purposes for which it had been obtained, it was our view that the disclosure by 
the Psychologist to the Supervisor of his contact with the complainant would have been in 
accordance with section 32(c) of the Act. 


However, we subsequently obtained additional information indicating that the Ambulance Service 
had a Health and Safety Unit (the Unit) which includes a Worker’s Compensation and 
Rehabilitation division. This division has the responsibility for dealing with employee 
occupational injury and illness, which includes: "The administration of WCB accident claims; 
Signing all compensation forms ensuring proper accuracy and completion; Reviewing all 
compensation claims ensuring compliance as required by the Workers’ Compensation Act 
including the submission of required reports and information". It is not, therefore, the 
Supervisor but the Unit which is primarily responsible for matters pertaining to health and safety 
in the workplace, including employee occupational injury and illness. 


In addition, we also obtained information regarding the confidentiality requirements for the 
Ambulance Service’s Critical Incident Stress Debriefing Team (the Team) of which the 
Psychologist is a member. This information indicates that emphasis is given to staff being 
"entitled to strict and complete confidentiality including anonymity of person and events..." in 
virtually all situations where a member of the Team was contacted. 


The Ambulance Service submitted information from the Corporate Health and Safety Manual 
outlining that a competent supervisor must "take every precaution reasonable in the 
circumstances for the protection of a worker", and a policy which states that "all levels of 
management have, as a primary responsibility, the safety and personal well-being of employees 
directly below them". The Ambulance Service has maintained that all supervisors have a 
responsibility to ensure the personal well-being of their employees, and a responsibility to the 
public, to ensure that employees are able to perform their duties. The Ambulance Service stated 
that it is not feasible in practice, or justifiable under the WCA or the Occupational Health and 
Safety Act, for the Unit to coordinate all matters pertaining to Health and Safety in the 
workplace, and to have the sole responsibility for these matters with employees. 


We have carefully reviewed all of the information provided. We remain of the view that one 
of the purposes for the complainant’s personal information being obtained by the Psychologist 
to assist him, would have reasonably been to ensure the well-being of the complainant as an 
employee. We acknowledge that supervisors do have some responsibility for the health and 
safety of their employees in addition to the Unit’s responsibilities. However, in our view, when 
the Ambulance Service established its Critical Incident Stress Debriefing Team, employee health 
and safety would have been a factor considered in its development. The policy of confidentiality 
of contact with the Team would have been drafted with the well-being of the employees who 
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used the services of the Team in mind. It is thus our view that the Team has the primary 
responsibility for ensuring the well-being of the employee, and as part of this responsibility, 
Team members are required to abide by the Ambulance Service’s confidentiality policy. Thus 
we regard the disclosure by the Psychologist of his contact with the complainant, which was 
contrary to this policy, not to have been for the well-being of the employee. 


Given the Ambulance Service’s policy of strict confidentiality regarding staff contact with the 
Team, it is our view that it was inappropriate for the Supervisor to have been informed by the 
Psychologist that contact had been made between the Psychologist and the complainant. Since 
it is our view that the Psychologist’s disclosure of his contact with the complainant to the 
Supervisor was not for the purpose of ensuring the well-being of the complainant as an 
employee, we do not consider the Psychologist’s disclosure to have been made for one of the 
purposes for which he had obtained the information. Therefore, it was not in accordance with 
section 32(c) of the Act. It is also our view that no other provisions in section 32 applied to this 
disclosure. 


Conclusion: The Psychologist’s disclosure to the Supervisor was not in accordance 
with section 32 of the Act. 


Issue C: Was the disclosure of personal information by the Supervisor to the Union 
Representative in accordance with section 32 of the Act? 


Section 32(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or treaty. 


A note written by the Union Representative contained details of discussions with the Supervisor 
about the complainant’s claim, and about the fact that the complainant had been seeing the staff 
Psychologist. 


The Ambulance Service submitted that this disclosure was in accordance with section 32(e) since 
it was authorized under Article 1 of the Collective Agreement established under the Labour 
Relations Act. According to the Ambulance Service, Article 1 of the Collective Agreement 
implies that an employee may request the Union to represent him/her at any disputed matter or 
grievance. In this particular situation, the complainant’s Supervisor was inquiring as to whether 
the Union Representative was in support of the complainant’s WCB claim. 


We have determined that the complainant had not asked his union representative to represent him 
regarding his WCB claim. 
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Article 1 of the Collective Agreement states: 


In this Agreement "employee" means a person hired by the Metropolitan Corporation for 
either the Permanent or Temporary Service, for a position which comes within the 
Bargaining Unit described in Article 2 hereof, and who is on the active payroll of the 
Metropolitan Corporation. 


It is our view that Article 1 of the Collective Agreement does not provide for the disclosure of 
the complainant’s personal information, in this case, by the Supervisor to the Union 
Representative. Therefore, the disclosure was not for the purpose of complying with an 
agreement made under an Act of the Legislature and thus, was not in accordance with section 
32(e) of the Act. 


We have examined the other provisions of section 32 which permit disclosure but have 
determined that none were applicable in the circumstances of this case. 


Conclusion: The Supervisor’s disclosure of the complainant’s personal information to the 
Union Representative was not in accordance with section 32 of the Act. 


Issue D: Were reasonable measures in place to prevent unauthorized access to personal 
information in accordance with section 3(1) of Regulation 823 under the Act, as 
amended by Regulation 395/91? 


Section 3(1) of Regulation 823, as amended by Regulation 395/91, states: 


Every head shall ensure that reasonable measures to prevent unauthorized access 
to the records in his or her institution are defined, documented and put in place, 
taking into account the nature of the records to be protected. 


It is our understanding that during the day, supervisors may record various daily incidents in 
notebooks or logs. According to the complainant, the supervisors’ logs are located in the 
management office and are accessible by all management staff. 


The Ambulance Service has advised that the logs are kept locked in wooden boxes located in the 
basement of the area office. When supervisors are on the road these logs are kept with them 
at all times. At the end of the day when supervisors return to the office, the logs are returned 
to the wooden boxes. Supervisors have a key to their own boxes. The Area Manager also has 
a key to each individual box but uses the key only in emergencies when the supervisor is away 
from the office or on vacation. 


We have reviewed these procedures and it is our view that reasonable measures are in place to 


prevent unauthorized access to supervisors’ logs while they are in the area office. However, 
section 3(1) of the Regulation requires that these measures be "defined" and "documented". 
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In a previous investigation which also involved supervisors’ logs (in part), we found that the 
Ambulance Service’s Privacy Guidelines did not address the matter of supervisors’ logs and the 
measures in place to prevent their unauthorized access. We noted that no steps had yet been 
taken by the Ambulance Service to do so. 


Conclusion: Reasonable measures are in place to prevent unauthorized access to the 
personal information contained in the supervisors’ logs while they are in 
the area office. However, these measures have not been "defined" and 
"documented", as required by section 3(1) of Regulation 823 under the 
Act, as amended by Regulation 395/91. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 

e The Psychologist’s disclosure to the Supervisor was not in accordance with section 32 
of the Act. 

e The Supervisor’s disclosure of the complainant’s personal information to the Union 
Representative was not in accordance with section 32 of the Act. 

e Reasonable measures are in place to prevent unauthorized access to the personal 
information contained in the Supervisors’ logs while they are in the area office. 
However, these measures have not been "defined" and "documented", as required by 
section 3(1) of Regulation 823 under the Act, as amended by Regulation 395/91. 

RECOMMENDATIONS 


We recommend that: 


| 


The Ambulance Service should take steps to ensure that in future all disclosures of 
personal information are made in accordance with the Act. 


The Ambulance Service’s Privacy Guidelines should include information regarding the 
measures in place for the safe storage of supervisors’ logs, and access to them. 
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Within six months of receiving this report, the Ambulance Service should provide the Office of 
the Information and Privacy Commissioner/Ontario with proof of compliance with the above 
recommendations. 


Original signed by: October 4, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named municipality (the 


City). 


At 10:30 a.m. on March 28, 1992, the complainant wrote a test entitled the "Entry Firefighter 
Test" (the test), with the City. The test was one of the steps in the City’s firefighter recruitment 
process. The complainant stated that the test had asked for the applicants’ race and sex. The 
complainant indicated on his test answer sheet that he was a white male. 


The City sent the completed test answer sheets to a private company in Sacramento, California, 
in order to be marked. The complainant scored 82 percent on the test, while the cut-off mark 
for white males was 85 percent. The cut-off mark for females and visible minorities was 70 
percent. 


Regarding the test, the complainant stated the following: 


ey The City ... did not state their authority, verbal or written, to collect this 
information on a test score sheet. 


2 The information that was supplied to them [the City] was used for a 
purpose other than what I was told it would be used for. 


s They [the City] released this confidential information to a third party, 
namely [the named private company], without my permission. 


During a meeting with the Compliance Investigator, the complainant outlined an additional 
concern. He stated that the City’s Employment Recruiter and its Secretary of Human Resources 
had access to the "test analysis printouts", which identified the individuals who had written the 
test by their name, sex, race and social insurance number (SIN). The complainant questioned 
the authority of these two individuals to have access to this personal information. 


The complainant also stated that while the City had the authority to collect the pre-employment 
data on its employment application form, it did not have the authority to collect it on the test 
answer sheet. The complainant also questioned the City’s authority to disclose his SIN to the 
private company. 


The complainant thus questioned the City’s authority to collect, use and disclose his pre- 
employment data consisting of his race and sex, and to disclose his SIN to the private company. 
The complainant also questioned the authority of the City’s Employment Recruiter and Human 
Resources Secretary to have access to the test analysis printouts. 
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Issues Arising from the Investigation 
The following issues were identified as arising from this investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? 


(B) Did the City have the authority to collect the pre-employment data, in accordance 
with section 28(2) of the Act? 


(C) Did the City provide notice of its collection, in accordance with section 29(2) of 
the Act? 


(D) Did the City use the pre-employment data, in accordance with section 31 of the 
Act? 


(E) Did the City disclose the pre-employment data, in accordance with section 32 of 
the Act? 


(F) Did the City disclose the SIN, in accordance with section 32 of the Act? 

(G) Did the Employment Recruiter and the Human Resources Secretary obtain access 
to the test analysis printouts, in accordance with section 3(2) of Regulation 823 
under the Act, as amended by Regulation 395/91? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
age, sex, sexual orientation or marital or family status of the individual, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, 


(c) any identifying number, symbol or other particular assigned to the 
individual, 
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(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; ("renseignements personnels") 


We obtained a copy of the complainant’s test answer sheet. It contained the following 
information: his name, sex, race, SIN, and the highest grade he had completed in school. 


We also obtained a copy of the test analysis printout. It contained the following information 
about the complainant: his name, SIN, the letter "M" for male, and the letter "W" for white. 


It is our view that the information contained in the complainant’s test answer sheet and the test 
analysis printout met the requirements of paragraphs (a), (b), (c) and (h) of the definition of 
"personal information", in section 2(1) of the Act. 


Conclusion: The information contained in the complainant’s test answer sheet and the 
test analysis printout was personal information, as defined in section 2(1) of the Act. 


Issue B: __ Did the City have the authority to collect the pre-employment data, in 
accordance with section 28(2) of the Act? 


Section 28(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. 


The City submitted the following: 


Yes, the City solicited the information in question. It was verbally requested at 
each of the entry level firefighter tests conducted on March 27 and 28, 1992, at 
which time Fire Chief ... indicated that providing this information was optional. 


The City collected this information under the authority of Section 28(2) on the 
basis that the collection was necessary to administer a lawfully authorized 
activity (being a special Employment Equity Program). In this regard, please 
refer to Section 14 of the Human Rights Code ... and the Ontario Human Rights 
Guidelines on Special Programs .... (emphasis added) 


Section 14(1) of the Ontario Human Rights Code (the Code) states: 
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A right under Part I is not infringed by the implementation of a special program 
designed to relieve hardship or economic disadvantage or to assist disadvantaged 
persons or groups to achieve or attempt to achieve equal opportunity or that is 
likely to contribute to the elimination of the infringement of rights under Part I. 
[emphasis added] 


Part I of the Code addresses "Freedom from Discrimination". It prescribes a number of rights, 
including the right to equal treatment with respect to employment without discrimination [section 


5(1)]. 


On page two of the "Ontario Human Rights Commission Guidelines on Special Programs", dated 
May 1991, the following is stated: 


... section 28(c) [now section 29(c)] gives the Ontario Human Rights Commission 
an active mandate to facilitate and encourage the implementation of special 
programs that comply with section 13 [now section 14]. The Commission, 
therefore, supports and encourages ... employers ... to voluntarily adopt special 
programs. [emphasis added] 


Section 29(c) of the Code states: 


It is the function of the Commission, 


(c) to recommend for consideration a special plan or program designed to 
meet the requirements of subsection 14(1), subject to the right of a person 
aggrieved by the implementation of the plan or program to request the 
Commission to reconsider its recommendation and section 37 applies with 
necessary modifications; 


On page five of the "Guidelines on Special Programs", the following is further stated: 
No person is obliged to seek an order from the Commission prior to 
implementing a special program, nor is the Commission obligated to issue an 
order in response to an application. 

In fact, the Commission encourages ... employers ... to review their own 
operations in light of these guidelines, with a view to voluntarily undertaking 
initiatives aimed at promoting greater equality in our society. 

The City also submitted that: 

... the [Ontario Human Rights] Commission has considered the City’s request for 


a special program and on March 6, 1989, the Chief Commissioner advised that 
the proposal meets the definition of a special program under Section 14. 
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The proposal being referred to above is the City’s "Pre-Employment Applicant Tracking 
Programme". The complainant provided us with a copy of the City’s proposal in this regard, 
dated July, 1988. 


The proposal included two sections entitled "Tracking Information To Be Requested" and "Data 
Collection Process". Under "Tracking Information To Be Requested", the following is stated: 


People applying for employment with [the named City] will be requested to 
provide, on a voluntary and confidential basis, personal information related to 
their sex, race and disability. 


Under "Data Collection Process", the following is stated: 


We will be modifying our current application form somewhat by including a 
’Recruitment Questionnaire’ insert and an envelope addressed to the attention of 
the Employment Equity Officer. Pre-employment applicant tracking information 
will be requested via this Recruitment Questionnaire. 


The complainant stated that he applied for the firefighter job by completing the employment 
application form. He also stated that he had completed the recruitment questionnaire, which he 
returned to the City, by placing it in a locked box, set up for this purpose, in the City’s Human 
Resources Department. 


In our view, whether the City initially collected the pre-employment data through the 
employment application form or on the test is irrelevant to the main issue of whether they had 
the authority to collect it. We believe that the City had the authority to collect the complainant’s 
pre-employment data on the employment application form because the collection was "necessary" 
for the proper administration of a lawfully authorized activity, namely -- a special program under 
section 14(1) of the Ontario Human Rights Code. However, it is also our view that any 
subsequent collections of the complainant’s pre-employment data by the City for the purpose of 
administering its special program would no longer be "necessary". Accordingly, it is our view 
that the City’s second collection of the complainant’s pre-employment data, on the test, did not 
meet the provisions of section 28(2) of the Act. 


Conclusion: The City’s first collection of the complainant’s pre-employment data (on 
the employment application form) was in accordance with section 28(2) of the Act, as 
it was "necessary" for the proper administration of a lawfully authorized activity, 
namely, the City’s special program. 


The City’s second collection of the complainant’s pre-employment data (on the test) was 
not necessary for the proper administration of the City’s special program, since the City 
was already in possession of that information. Thus, the City did not meet the provisions 
of section 28(2) of the Act, in this second instance. 
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Issue C: Did the City provide notice of its collection, in accordance with section 29(2) 
of the Act? 


Section 29(2) of the Act requires an institution to notify the individual to whom the personal 
information relates of what information the institution is collecting and why. It states: 


If personal information is collected on behalf of an institution, the head shall 
inform the individual to whom the information relates of, : 


(a) the legal authority for the collection; 


(b) the principal purpose or purposes for which the personal information is 
intended to be used; and 


(c) the title, business address and business telephone number of an officer or 
employee of the institution who can answer the individual’s questions 
about the collection. 


In this regard, the complainant stated: "The City ... did not state their authority, verbal or 
written, to collect this information on a test score sheet". 


The complainant also stated that before writing the test, the Fire Chief gave the applicants verbal 
instructions on how to fill out the test answer sheet. Regarding the pre-employment data, the 
complainant said the Fire Chief explained that it would be used by the private company, but that 
no employment decisions would be based on it. 


The City submitted: 


It would appear that applicants were not informed of the purpose of the collection 
as was the case at the 8:00 a.m. sitting. Specifically, they were not told that the 
sex and ethnicity data would be used for statistical purposes, nor was the 
statement made that no employment decisions would be based on this information. 


In the section entitled "Background of the Complaint", we indicated that the complainant had 
written the test at 10:30 a.m. on March 28, 1992. In its submission, the City stated that the "... 
applicants [at the 10:30 a.m. sitting] were not informed of the purpose of the collection as was 
the case at the 8:00 a.m. sitting". On March 28, 1992, the test had been written at 8:00 a.m. 
and 10:30 a.m., by two different groups of applicants. Prior to receiving this complaint, we had 
investigated another complaint, also regarding the City’s recruitment of firefighters. The 
complainant in the first complaint (Investigation I92-72M) had written the test at the 8:00 a.m. 
sitting, at which time the Fire Chief told the applicants that the pre-employment data would be 
principally used for statistical purposes. 


In its submission, as outlined above, the City responded only to section 29(2)(b) of the Act. It 
stated that the applicants at the 10:30 a.m. sitting were not informed of the purpose of the 
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collection. The City did not, however, respond to sections 29(2)(a) or (c) of the Act. We have 
relied on the City’s submission to the first complaint, to make a finding in this regard. (Please 
note that since many of the issues identified in both complaints were similar, the City agreed to 
have its response to the first complaint applied to the second complaint, where the issues were 
the same.) 


In its earlier submission to Investigation I92-72M, the City stated: 


The form of the notice was not strictly in accordance with that outlined in Section 
29(2) of the Act to the extent that legal authority was not specified, nor was a 
contact person indicated who could answer any questions about the collection. 


Based on the above, it is our view that the City did not provide proper notice of collection, in 
accordance with section 29(2) of the Act. 


Conclusion: The City did not provide notice of collection, in accordance with section 
29(2) of the Act. 


Issue D: Did the City use the pre-employment data, in accordance with section 31 of 
the Act? 


Section 31 of the Act prohibits the use of personal information, unless one of three conditions 
exist. It states: 


An institution shall not use personal information in its custody or under its control 
except, 


(a) if the person to whom the information relates has identified that 
information in particular and consented to its use; 


(b) for the purpose for which it was obtained or compiled or for a consistent 
purpose; or 


(c) for a purpose for which the information may be disclosed to the institution 
under section 32 or under section 42 of the Freedom of Information and 
Protection of Privacy Act, 1987. 


The complainant stated: "The information that was supplied to them [the City] was used for a 
purpose other than what I was told it would be used for". The complainant believed that the 
City used the pre-employment data to aid it in its firefighter selection process -- a purpose for 
which the City had not stated it would use this information. In this regard, the complainant 
provided us with the City’s brochure entitled "Enjoy a challenging and worthwhile career", 
which contained the following excerpt: 


[IPC Investigation 193-003M/August 5, 1993] 


Lf ae 


The [named City] is an Equal Opportunity Employer, therefore an individual’s 
age, race, sex, sexual orientation, and/or religion are not factors in our selection 
process. 


Regarding its use of the pre-employment data, the City submitted: 


The City used the pre-employment data in the same manner outlined in our 
submission relative to Investigation #192-72M, notwithstanding that notice of the 
purpose of the collection was not given at the 10:30 a.m. sitting. Therefore, I 
would assume that the same submission and Compliance Officer’s 
recommendations would apply in this instance. 


In its submission to Investigation I92-72M, the City stated: 


The data was sorted by [the named private company] based on employment equity 
parameters (see attached Schedule No. 3) in order that the aggregate data could 
be used for comparison to prior years and to administer (relative to the firefighter 
hiring process) the Special Employment Equity Program approved by the Human 
Rights Commission. 


There were 1,954 applicants for the firefighter positions, 1,608 of whom wrote 
entry level test No. 1. The aggregate data compiled by [the named private 
company] revealed that there was a disproportionately small number of women 
and visible minority candidates, being 70 of the 1,282 who achieved a pass mark 
of 70% or better on Test No. 1. Given the number of vacancies to be filled (20- 
25) and the City’s past experience with failure rates on physical-medical tests (30- 
35%) it was decided that 350 candidates should proceed to Test No. 2. It was 
also decided that given the small number of minority candidates, all of the 70 
who attained a pass mark on Test No. 1 should proceed to Test No. 2. This 
meant that the number of white male applicants had to be reduced to 280 and this 
was done by examining the marks on Test No. 1 to determine an appropriate 
cutoff mark which would yield approximately 280 white male candidates. 


The City did not inform the applicants at the 10:30 a.m. sitting of the principal purpose or 
purposes for which the pre-employment data was intended to be used. Thus, it is our view that 
the City may not rely on section 31(a) to authorize its use of the pre-employment data, because 
the complainant could not have consented to a use that he was never told about. 


In the absence of a proper notice of collection, and given the statement in the City’s brochure 
that an individual’s age, race, sex, sexual orientation and/or religion are not factors in its 
selection process, it is our view that the City cannot be said to have used the data "for the 
purpose for which it was obtained or compiled", in accordance with section 31(b) of the Act. 


It is also our view that the City did not use the pre-employment data for a "consistent purpose", 
in accordance with section 31(b). A consistent purpose is one which the complainant would 
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have reasonably expected. It is our view that in the circumstances of this complaint, where 
proper notice of collection was not given, and given the statements made in the City’s brochure, 
the complainant would not have reasonably expected the City to use his pre-employment data 
as criteria in its hiring decision. 


We also reviewed section 31(c) of the Act and found that it did not apply to the circumstances 
of this complaint. . 


Conclusion: The City did not use the pre-employment data in accordance with section 
31 of the Act. 


Issue E: Did the City disclose the pre-employment data, in accordance with section 32 
of the Act? 


Section 32 of the Act prohibits the disclosure of personal information by an institution, except 
in certain circumstances. (For the full text of section 32, please refer to Appendix A.) 


The complainant stated: "They released this confidential information to a third party, namely 
(the named private company), without my permission". 


The City submitted that sections 32(b) and (c) of the Act authorized its disclosure of the 
applicants’ pre-employment data to the private company. We examined each of the City’s 
positions separately. 


Section 32(b) of the Act 
Section 32(b) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(b) if the person to whom the information relates has identified that 
information in particular and consented to its disclosure; 


The City submitted: 


Yes, the answer sheets were disclosed to [the named private company] in order 
to allow them to computer mark Test No. 1 and to prepare the statistical 
summary [i.e., the "Test Analysis"]. Staff believe that this was authorized 
pursuant to Section 32(b) as the information was provided voluntarily. In 
providing this information, the applicant would have known based on the 
computer format of the answer sheet, that the data would have to be electronically 
sorted and scored. 
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It is our view that while the computer format of the test answer sheet may have suggested to the 
applicants that the data would have to be electronically sorted and scored, the format did not 
suggest that a private company in California would be doing the sorting and scoring. In fact, 
the "Test Security Agreement” between the City and the private company allows for the client 
or purchaser of the test to score the test. 


Thus, it is our view that the City may not rely on section 32(b) of the Act to authorize its 
disclosure of the pre-employment data to the private company, for marking purposes. 


Section 32(c) of the Act 
Section 32(c) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose, 


-In its submission to I92-72M, the City stated: "... the disclosure for tabulation purposes was 
required to generate the statistics necessary in order to forward the City’s Employment Equity 
Program". 


In the circumstances of this complaint, and especially given the absence of a proper notice of 
collection, it is our view that the City cannot be said to have disclosed the pre-employment data 
"for the purpose for which it was obtained or compiled", in accordance with section 32(c) of the 
Act. And, since the City did not inform the complainant of the principal purpose or purposes 
for which the pre-employment data was intended to be used, it cannot be said that the 
complainant might reasonably have expected this disclosure. Therefore, it is our view that the 
City did not disclose the complainant’s pre-employment data for a "consistent purpose”, in 
accordance with section 32(c) of the Act. 


We reviewed the remaining exceptions listed in section 32 of the Act and found that none 


applied to this disclosure of personal information. Accordingly, it is our view that the City’s 
disclosure of the personal information was not in accordance with section 32 of the Act. 


Conclusion: The City’s disclosure of the complainant’s pre-employment personal 
information was not in accordance with section 32 of the Act. 


[IPC Investigation 193-003M/August 5, 1993] 


Sti} 


Issue F: Did the City disclose the complainant’s SIN, in accordance with section 32 of 
the Act? 


The complainant questioned the City’s authority to disclose his SIN to the private company. 


In its submission to I92-72M, the City stated: "... the disclosure for tabulation purposes was 
required to generate the statistics necessary in order to forward the City’s Employment Equity 
Program". ; 


In our view, the City did not need to disclose the applicants’ SIN to generate the statistics 
necessary for its employment equity program. We reviewed section 32 of the Act and found that 
none of the exceptions listed applied to this disclosure. Accordingly, it is our view that the 
City’s disclosure of this personal information was not in accordance with section 32 of the Act. 


Conclusion: The City’s disclosure of the complainant’s social insurance number was 
not in accordance with section 32 of the Act. 


Issue G: Did the Employment Recruiter and the Human Resources Secretary obtain 
access to the test analysis printouts, in accordance with section 3(2) of 
Regulation 823 under the Act, as amended by Regulation 395/91? 


Section 3(2) of Ontario Regulation 823 states: 


Every head shall ensure that only those individuals who need a record for the 
performance of their duties shall have access to it. 


The City confirmed that the Employment Recruiter and the Information Clerk (i.e., the Secretary 
of Human Resources) had access to the test analysis printout. It also submitted the following: 


It is the City’s position that the above staff members required access to 
information in the test analysis printout in order to perform their respective 
duties. The Employment Recruiter is involved in all stages of the hiring process 
including the Selection Committee which decides who will proceed to the next 
level of testing based on test performance and the parameters of the City’s 
Employment Equity Program 


The Information Clerk performs all administrative duties for the Employment 
Recruiter throughout the entire testing process. These include advising any of the 
1,600 applicants of their test results where these have been requested by them 
either in person or in writing. 


We concur with the City that the Employment Recruiter and the Information Clerk needed access 
to the test analysis printouts for the performance of their duties. 
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Conclusion: The Employment Recruiter and the Information Clerk obtained access to 
the test analysis printouts, in accordance with section 3(2) of Ontario Regulation 823. 


Other Matters 


In Issue F we concluded that the City’s disclosure of the complainant’s social insurance number 
was not in compliance with section 32 of the Act. . 


With respect to social insurance numbers, we would also like to draw the City’s attention to the 
IPC’s most recent publication of "Practices" dated April, 1993 (copy enclosed). In this issue, 
we addressed the collection, retention, use, and disclosure of social insurance numbers. Our 
main purpose was to heighten awareness of the privacy implications associated with the SIN, 
when used as a unique personal identifier. 


SUMMARY OF CONCLUSIONS 


The information contained in the complainant’s test answer sheet and the test analysis 
printout was personal information, as defined in section 2(1) of the Act. 


The City’s first collection of the complainant’s pre-employment data (on the employment 
application form) was in accordance with section 28(2) of the Act, as it was "necessary" 
for the proper administration of a lawfully authorized activity, namely, the City’s special 
program. 

The City’s second collection of the complainant’s pre-employment data (on the test) was 
not necessary for the proper administration of the City’s special program, since the City 
was already in possession of that information. Thus, the City did not meet the provisions 
of section 28(2) .of the Act, in this second instance. 


The City did not provide notice of collection, in accordance with section 29(2) of the 
Act. 


The City did not use the pre-employment data in accordance with section 31 of the Act. 


The City’s disclosure of the complainant’s pre-employment personal information was not 
in accordance with section 32 of the Act. 


The City’s disclosure of the complainant’s social insurance number was not in accordance 
with section 32 of the Act. 


The Employment Recruiter and the Information Clerk obtained access to the test analysis 
printouts, in accordance with section 3(2) of Ontario Regulation 823. 
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RECOMMENDATIONS 


ike With regard to the third condition of section 28(2) of the Act, we recommend that the 
City collect personal information only in those instances where the collection is truly 
"necessary" to the proper administration of a lawfully authorized activity. 


Ds Except where notice has been waived or section 29(3) of the Act applies, we recommend 
that each time the City collects personal information, it inform the individual to whom 
the information relates of the following, pursuant to section 29(2) of the Act: 


- the legal authority for the collection; 

- the principal purpose(s) for which the information is to be used; and 

- the address and telephone number of an official within the City who may answer 
questions about the collection. 


ahs We recommend that the City use personal information only in accordance with section 
31 of the Act. 
4, Since the named private company has physical possession of the test answer sheets 


containing the applicants’ pre-employment personal information, we recommend that the 
City establish a formal written agreement with the company in Sacramento, California, 
requiring that it comply with the applicable privacy provisions of the Act. 


ay; As an alternative to recommendation #4, the City may in future wish to consider 
removing the personal identifiers from all test answer sheets, prior to disclosing this 
information to the private company. 


6. We recommend that the City not disclose any personal information unless one of the 
exceptions to the prohibition against disclosure, as cited in section 32 of the Act, applies. 


Since the above recommendations are the same as those contained in Investigation I92-72M, the 
City should provide the Office of the Information and Privacy Commissioner with proof of 
compliance with these recommendations, at the same time that it responds to I92-72M. 


Original signed by: August 5, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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APPENDIX A 


An institution shall not disclose personal information in its custody or under its control 
except, 


in accordance with Part I; 


if the person to whom the information relates has identified that information in particular 
and consented to its disclosure; 


for the purpose for which it was obtained or compiled or for a consistent purpose; 
if the disclosure is made to an officer or employee of the institution who needs the record 
in the performance of his or her duties and if the disclosure is necessary and proper in 


the discharge of the institution’s functions; 


for the purpose of complying with an Act of the Legislature or an Act of Parliament, an 
agreement or arrangement under such an Act or treaty; 


if disclosure is by a law enforcement institution, 


(i) to a law enforcement agency in a foreign country under an arrangement, a written 
agreement or treaty or legislative authority, or 


(ii) to another law enforcement agency in Canada; 

if disclosure is to an institution or a law enforcement agency in Canada to aid an 
investigation undertaken with a view to a law enforcement proceeding or from which a 
law enforcement proceeding is likely to result; 

in compelling circumstances affecting the health or safety of an individual if upon 
disclosure notification is mailed to the last known address of the individual to whom the 


information relates; 


in compassionate circumstances, to facilitate contact with the next of kin or a friend of 
an individual who is injured, ill or deceased; 


to the Minister; 
to the Information and Privacy Commissioner; 


to the Government of Canada or the Government of Ontario in order to facilitate the 
auditing of shared cost programs. 
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INTRODUCTION 


Background of the Complaint 
This investigation was initiated as a result of a complaint concerning a Municipal City (the City). 


The complainant is a member of the City’s Fire Department. A Professional Fire Fighters’ 
Association (the Association) is representing the interests of the complainant for purposes of this 
investigation. 


At a fire scene in December 1992, statements were made by certain fire fighters regarding 
possible staff reductions in the fire department. A member of the public at the fire scene 
registered a complaint with a City councillor regarding these statements saying they were 
unprofessional and unethical. As a result of this incident, the Mayor of the City appointed the 
City Auditor to investigate the matter along with the Deputy Fire Chief. A preliminary 
investigation report (the report) was produced which identified the complainant as one of the fire 
fighters who had made some of the statements in question. The City stated that this report was 
stamped "confidential". No additional fire fighters were identified. 


The press obtained the information in the report and contacted the complainant for a statement. 


The press subsequently printed information from the report in a newspaper article. 


The Association has submitted that the City disclosed the report, containing the complainant’s 
personal information, contrary to section 32 of the Municipal Freedom of Information and 
Protection of Privacy Act (the Act). 

Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of Act? 


(B) Was the disclosure to the press in accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 2(1) 
of Act? 


Section 2(1) states, in part: 


"personal information" means recorded information about an _ identifiable 
individual, including, 
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(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The information in question was a five page report written by the City Auditor containing the 
results of the investigation of the complaint to the City councillor. It identified the complainant 
as having made certain statements to the tenants at the fire scene. It also gave details of the 
interview conducted by the City Auditor with the complainant. 


In our view, the report contained information which met the requirements in paragraph (h) of 
the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the disclosure in accordance with section 32 of the Act? 


The City has informed us that it cannot determine who gave the information and/or the report 
to the press. The City has advised that once the investigation was completed, the report in 
question was delivered to the Fire Chief’s Office on December 31, 1992. This copy was filed 
in a locked drawer where only the Deputy Chief had access. The report was also sent to the 
Chief Administrative Officer of the City (CAO), on December 31, 1992. On January 4, 1993, 
the report was sent to the Mayor of the City and each member of Council. The City informed 
us that the report was also sent to the Association and on January 4 or 5, 1993, a copy was 
given to the individual who filed the complaint initially. The Association informed us that it 
received the report on January 11, 1993. The City Auditor, who wrote the report, filed his copy 
in the CAO/Audit Records Office where only Audit staff and the records clerk had access. 


According to the City, therefore, the City Auditor, the Deputy Fire Chief, the Fire Chief, the 
CAO, the Mayor, all members of the City Council, the Association, and the individual who filed 
the initial complaint with the City councillor, all had copies of the report prior to the date of the 
newspaper article, which was January 5, 1993. 


We requested that the City contact each of the above identified individuals, excluding the 
individual who filed the initial complaint, to inquire whether they had disclosed the confidential 
report or the information in the report to any other individual, including the press. The City 
informed us that all of the individuals completed and signed forms which indicated that they had 
not disclosed the report or its contents to any other individual. 


We contacted the individual who filed the initial complaint with the City councillor to determine 
whether she had provided a copy of the report to the press. She informed us that she was out 
of the province until January 4, 1993. She went back to work on January 5, 1993, and, at that 
time, saw a copy of the report and the newspaper article. She did not have a copy of the report 
before the newspaper article was printed on January 5, 1993. 
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Since none of the individuals who were identified as having access to the report, acknowledged 
disclosing the report or the information it contained to the press, we were unable to determine 
who disclosed the personal information. Therefore, we were unable to establish conclusively if 
the City made the disclosure. 


We have, however, examined the provisions of section 32 of the Act which permits disclosure 
in specific circumstances. It is our view that if the City had disclosed the personal information 
to the press, the disclosure would not have been in accordance with section 32 of the Act. 


Conclusion: We were unable to determine who disclosed the personal information. 


However, if the City had disclosed the personal information, the 
disclosure would not have been in accordance with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e We were unable to determine who disclosed the personal information. However, if the 


City had disclosed the personal information, the disclosure would not have been in 
accordance with section 32 of the Act. 


RECOMMENDATIONS 


In our draft report we stated that although we were unable to determine if the City disclosed the 
personal information to the press, we would nevertheless like to make the following 
recommendation. 


The City should take steps to ensure that with respect to investigations of this nature, it is clearly 
communicated to those who have access to the investigative report that it remain confidential, 
and that any disclosure of personal information should be made in accordance with the 
provisions of the Act. This advice should be reflected in the City’s procedures for conducting 
such investigations. 

In reply to this recommendation, the City advised that: 


ue The City Auditor has initiated guidelines to his staff on the procedures to be followed in 
the handling of future internal investigation reports. These include: 


Reports should only contain personal information where absolutely necessary. 
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When a report does contain personal information, its circulation should be as 
restricted as possible; and such circulation should be approved specifically by the 
City Auditor or the Director of Audit Services. 


Each report should have on its cover page a Statement that it does contain 
personal information and that the disclosure of such information is governed by 
the Act. 


Each page of the report which contains personal information should incorporate 
a similar advisory/cautionary statement. 


Personal information collected in the course of audits or investigations, whether 
incorporated in reports or not, must be collected, handled and stored with full 
confidentiality and in accordance with the requirements of the Act. 


Pe Each investigative report will have on its cover page a statement that it does contain 
personal information and that the disclosure of such information is governed by the Act. 


ab When the Commissioner’s final report is received, a memo will be issued to all 
Departments and Council advising them of the Commissioner’s report and 
recommendation. Guidelines similar to those developed for the City Auditor’s 
Department will be incorporated into the City’s Municipal Freedom of Information and 
Protection of Privacy Guidelines and Procedure Manual. 


4, Departments will be reminded of previous communication sent to them with suggested 
wording to be used to advise members of Council when they are being provided with 
information with potential exemptions under the Act. 


ay The City Auditor has made a clear indication of willingness to comply with the 
recommendation in the Commissioner’s report and avoid inappropriate disclosure in the 
future. 


We have carefully considered the City’s submissions and are satisfied with its comprehensive 
response to our recommendation. 


Onginal signed by: July 28, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named municipal city (the 


City). 

The complaint was that the City had failed to provide proper notice for the collection of personal 
information on its License Renewal Application (the Application), as it pertained to taxicab 
drivers and owners, contrary to the Municipal Freedom of Information and Protection of Privacy 
Act (the Act). The complainant was also concerned that the City was collecting financial and 
criminal record information about taxi drivers and owners without the proper legal authority to 
do so. 

The complainant was specifically concerned with questions one, two and three on the 
Application. These questions were related to bankruptcy proceedings, outstanding judgements, 
and criminal convictions. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information requested in the Application "personal information" as 
defined in section 2(1) of the Act? If yes, 


(B) Did the City have the authority to collect the personal information, in accordance 
with section 28(2) of the Act? 


(C) Did the City provide notice of its collection, in accordance with section 29(2) of 
the Act? 
RESULTS OF THE INVESTIGATION 


Issue A: Was the information requested in the Application "personal information" as 
defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 
(b) information relating to the education or the medical, psychiatric, 


psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
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been involved, (emphasis added) 


The complainant provided us with a copy of the Application. It contained questions about 
criminal and financial matters relating to the applicant. 


It is our view that the information requested in the Application met the requirements of 
paragraph (b) of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information requested in the Application was personal 
information, as defined in section 2(1) of the Act. 
Issue B: Did the City have the authority to collect the personal information, in 
accordance with section 28(2) of the Act? 

Section 28(2) of the Act states: 
No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 


activity. (emphasis added). ( 


We have examined the City’s collection of criminal record and financial information separately, 
below. 


Criminal Record Information 


The City referred us to Bylaw 142-89, the Public Vehicle Licensing By-law, section 18(3), 
which states: 


Grounds for Refusal to Issue or to Renew a License 


18. An applicant is entitled to be licensed and a licensee is entitled to have his 
licence renewed except where: 


(3) the issuance of the licence or renewal of the license would be 
contrary to the public interest; 


The City stated that the legal authority for the above provision is found in the Municipal Act, 
RSO 1990, c.M.45, s.232 as it relates to the regulation of the owners and drivers of cabs and 
other vehicles used for hire. Section 232 of the Municipal Act states in part that: 


By-laws may be passed by the councils of towns, villages and townships and by 
police services boards of cities: G 
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1. For licensing, regulating and governing ... owners and drivers of cabs ... 


The City also pointed to section 109 of the Municipal Act as providing the general authority to 
municipalities for the power to licence: 


(1) The power to license any trade, calling, business or occupation or the person 
carrying on or engaged in it includes the power to prohibit the carrying on of or 
the engaging in it without a licence. 


(2) The power to license, regulate or govern places or things includes a power to 
license, regulate or govern the trades, callings or business for which such places 
or things are used and the persons carrying on or engaged in them. 


Having reviewed By-law 142-89 and the relevant sections of the Municipal Act, it is our view 
that the licensing of taxicab owners and drivers was a "lawfully authorized activity”. 


In regard to the Application’s question concerning criminal convictions, however, the 
complainant felt that the City should not have requested information about convictions for which 
a pardon had been granted. 


As well, while the complainant agreed that the City had an obligation to ensure that the public 
was under no threat from a taxicab owner or driver, he felt that only specific criminal 
convictions should be collected, e.g. crimes of violence, and that the City’s request for 
information concerning all criminal convictions elicited confidential information at the expense 
of new applicants and licensees. 


In response to the complainant’s concern regarding pardoned convictions, the City revised its 
Application to read "Since you were last licensed by this licensing section, have you been 
convicted under any law of any country, province, or state thereof, of any criminal offence or 
any other offence for which a pardon has not been granted?" (emphasis added). The City 
sent us a copy of the revised form, and advised us that it is now in general use. 


However, the revised form did not address the complainant’s concern regarding the City’s 
collection of information on all criminal convictions (with the exception of those for which a 
pardon had been granted). In support of its stance that applicants should disclose details of all 
criminal convictions for which a pardon had not been granted, the City contended that, under 
the provisions noted above, it is authorised to regulate licences based on past conduct of 
applicants "as a measure of reasonable grounds for the belief that an applicant will carry on the 
licensed activity in accordance with the law and with integrity and honesty." 


The City also argued that section 18(3) of By-law 142-89 provides that a license not be issued 


if such issuance or renewal would be contrary to the public interest. The City indicated that 
collection of only specific criminal offenses, such as crimes of violence, might not provide 
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sufficient information to determine whether the public interest is best served through the issuance 
or renewal of a particular license. The City further stated that while not all criminal convictions 
would be a deterrent to the issuance of a license, it is important that the City be aware of the 
past conduct of an applicant who desires to perform an important public service function in the 
community. 


Having reviewed By-law 142-89, the relevant sections of the Municipal Act and the above 
submissions, it is our view that the City needs to collect information about an applicant’s 
convictions for all criminal offenses for which a pardon has not been given, in order to fulfil its 
role in protecting the public interest. It is thus our view that the City had the authority to collect 
information relating to criminal convictions, from both taxicab owners and drivers, as it was 
necessary to the proper administration of taxicab licensing. 


Conclusion: The City’s collection of criminal record information from taxicab 
owners and drivers was in accordance with section 28(2) of the 
Act. 


Financial Information 


The City contended that collection of the financial information was "necessary to the proper 
administration of a lawfully authorized activity". 


The City stated that Bylaw 142-89 contains the relevant section for the collection of financial 
information necessary for the purpose of regulating licenses. Section 18(1), in particular, states: 


Grounds for Refusal to Issue or to Renew a Licence 


18. An applicant is entitled to be licensed and a licensee is entitled to have his 
licence renewed except where: 


(1) having regard to his financial position, the applicant or licensee 
cannot reasonably be expected to be financially responsible in the 
conduct of the business which is to be licensed or is licensed; 
(emphasis added) 


As previously mentioned, based on By-law 142-89 and sections 109 and 232 of the Municipal 
Act, it is our view that the licensing of taxicab owners and drivers was a "lawfully authorized 
activity”. 


The complainant asserted, however, that the collection of financial information was not 
"necessary" to the proper administration of this activity. He stated that the financial information 
requested in the Application was irrelevant to the renewal of an owner’s or driver’s licence, and 
that the City’s by-law gave the City unlimited discretion to collect whatever financial information 
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it deemed necessary for the purpose of regulating licensees. 


The complainant also felt that other personal information (undefined) collected in the Application 
should satisfy the need for effective licensing administration. 


To determine whether the City’s collection of this financial information was "necessary" to the 
licensing of taxicab owners and drivers, we asked the City the following questions: 


|e Why is financial responsibility relevant in practice to the licensing of drivers and 
owners? 
Zr What problems would the City or public experience as a consequence of drivers or 


owners being or becoming insolvent? 


as How many licenses are refused as a consequence of collecting information on the 
financial status of the applicant? 


The City responded that they are aware of only a few problems (not specified) with drivers and 
Owners experiencing financial problems. The City believed that this success could be attributed 
to the fact that the applicant is asked about his/her financial well-being at the time of the 
application. 


The City further stated that financial responsibility is relevant to the licensing of drivers, as they 
are required to satisfy their payments to the owner of the taxicab and brokerage. In our view 
this item may be important for the owner, but is not necessarily a concern of the City. 


The City advised us that in the case of owners, the information is vital because the licence being 
issued has a monetary value on the open market. The City stressed that even though licenses 
may be transferred between parties or owners, the licences are considered the property of the 
City. However, the complainant stated that it was his view that agreements of purchase and sale 
are strictly private matters. . 


The City reiterated since it retains the ownership of the license at all times, it is the ultimate 
"owner". The City stated that because it is cognizant of its responsibility to the travelling public 
and to the taxicab industry, it has a keen interest in the financial status of the licensee. 


We understand that the concern of the City is that, if a licensee gets into financial difficulties, 
this may disrupt the provision to the public of the taxi service which has been licensed. The 
City gave a specific example of a case where, because the holder of a taxicab owner’s licence 
was bankrupted, the licence plate was not used for 2 1/2 years. 


The complainant contended that the example cited by the City was misleading, and that the 


licence was in fact actively operated through a lease agreement with a long-standing member of 
the industry during much of the period in question. The City’s rebuttal was that during the 


[IPC Investigation 193-008M/October 26, 1993] 


a 


entire investigation and court deliberation period, the plate was in the possession of the City’s 
License Manager. 


Leasing of Licenses 


We have determined that the leasing of licenses is not uncommon. 


Section 61(2) of the by-law states: 


(2) A licensed owner shall file with the licensing section all documents 
required to report any change, including, if applicable, a lease or sub- 
lease agreement or similar documentation relating to ownership or vehicle 
operation ... 


Therefore, the by-law specifically contemplates leases, which must be filed with the City. 


It seems likely that, in at least some cases, when the City talks about licensing drivers, those 
drivers may include people who drive taxicabs, but who are also lessees of the taxi licence. 


One of the implications of drivers also being lessees is that, as a taxi licence has been held to 
be personal property, the lease of such a licence may also be personal property. If the lessee 
gets into financial difficulties, the effect on the provision of the taxi service to the public could 
be much the same as where the owner has financial difficulties (depending on the terms of the 
lease agreement). 


In our view, the questions on the Application concerning bankruptcy status and judgement debts 
are more relevant to taxicab licence owners, who conduct the business of providing a taxicab 
service, than to taxicab drivers (at least where the driver is not also a lessee of the owner’s 
licence). The City advised us that of 1,487 licensed drivers, 696 drivers (46%) are lessees, 
partners, or owner/drivers. As such, these 696 individuals are lessees, with an interest in 
taxicab plates. 


The complainant challenged the City’s figures. He stated that there are only 472 taxicabs 
licensed by the City, and that the number of owners is considerably less than 472, since many 
control more than one licence. In response, the City stated that there is a distinction between 
plates and licences issued, and that while the number of taxi plates is 472, the actual number of 
licensed drivers, including owners, lessees and sub-lessees, is 1,487. 


Whatever the actual number may be, in the case of drivers, who are also lessees of licences, and 
owners, we accept the City’s argument that for these individuals conducting a business, and 
holding a property interest in taxicab plates, financial responsibility is an important consideration 
when renewing or granting licences. Therefore, we consider the collection of such basic 
financial information as bankruptcy status and outstanding judgements to be necessary to the 
proper administration of taxicab licensing. 
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] However, non-lessee drivers are not conducting a "business which is to be licensed or is 
licensed" by the City. It is thus our view that collection of the financial information from non- 
lessee drivers was not necessary to the proper administration of taxicab licensing. 


Conclusion: The City’s collection of financial information from drivers, who 
are also lessees of licences, and owners was in accordance with 
section 28(2) of the Act. 
The City’s collection of financial information from non-lessee 
drivers was not in accordance with section 28(2) of the Act. 
Issue C: Did the City provide notice of its collection, in accordance with section 29(2) 
of the Act? 


Section 29(2) of the Act states: 


If personal information is collected on behalf of an institution, the head shall 
inform the individual to whom the information relates of, 


(a) the legal authority for the collection; 


(b) the principal purpose or purposes for which the personal 
information is intended to be used; and 


(c) the title, business address and business telephone number of an 
officer or employee of the institution who can answer the 


individual’s questions about the collection. 


The City acknowledged that proper notice was not provided on the Application. However, in 
response to this complaint, the City revised its application form. It now contains a statement 
which complies with section 29(2) of the Act. 


Conclusion: The City did not provide notice of its collection, in contravention of 
section 29(2) of the Act. 


SUMMARY OF CONCLUSIONS 


e The information requested in the Application was personal information, as defined in 
section 2(1) of the Act. 


) e The City’s collection of criminal record information from taxicab owners and drivers was 
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in accordance with section 28(2) of the Act. 


e The City’s collection of financial information from drivers, who are also lessees of 
licences, and owners was in accordance with section 28(2) of the Act. 


e The City’s collection of financial information from non-lessee drivers was not in 
accordance with section 28(2) of the Act. 


& The City did not provide notice of its collection, in contravention of section 29(2) of the 
Act. 
RECOMMENDATION 


We acknowledge that the City has since provided proper notice on its Application. 


We recommend that the City discontinue the collection of financial information, i.e. the two 
questions concerning bankruptcy status and outstanding judgements, from non-lessee drivers. 
To achieve this, the City may wish to revise its Application, such that only drivers, who are also 
lessees of licences, and owners are instructed to complete questions one and two. 


Within six months of receiving this report, the City should provide the Office of the Information 
and Privacy Commissioner/Ontario with proof of compliance with the above recommendation. 


Original signed by: October 26, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a municipal school board 
(the Board). 


The complainant had been employed by the Board on a casual basis as an occasional teacher and 
had completed various short-term occasional teaching assignments between August, 1989 and 
December, 1992. In October, 1992, he applied for a long-term occasional position with the 
Board, and was selected as the successful candidate out of the job competition, in December, 
1992. He was then terminated from this long-term occasional contract in January of 1993. 


The complainant was asked by the Assistant to the Board’s Staffing Superintendent to provide 
the Board with the names of individuals who could be contacted by the Board for reference 
purposes. The Assistant said that the complainant told her the names of seven individuals, but 
he was uncertain if they were still employed at their respective boards, or of their current 
whereabouts. She recorded the list of referees on a page from a notepad, and told him that they 
would be contacted. She then passed the list on to the Staffing Superintendent. 


The Staffing Superintendent found that of two of the referees for the [named board], one was 
not known at the board, and one was a retiree. However, she wished to obtain a reference from 
the [named] board, and later, at a meeting of Staffing Superintendents, in a personal 
conversation, the Staffing Superintendent asked the Superintendent of the [named board] if there 
was someone he might know whom she could contact to obtain a reference for the complainant. 
He told the Staffing Superintendent that the complainant’s contract had been terminated by his 
board, and that an arbitration decision was available. He did not provide any details to the 
Staffing Superintendent. 


The Staffing Superintendent had not been previously aware that the complainant’s prior 
employment with the [named board] had been terminated for unsatisfactory performance. She 
subsequently received a copy of the arbitration decision from the Board’s lawyer. The 
arbitration decision stated in part: 


Thus, it is the conclusion of this board of arbitration that the Board was correct 
in its action of dismissal and further that there is no evidence before this board 
which could justify reinstatement... 


We are concerned that respect for the spirit of the document [the collective 
agreement] was not reflected by the speed with which the administration and the 
Board acted in the last week of April and the month of May. That part of the 
process is seen by us as "unjust" and warrants a remedy for the grievor which 
remedy can only be by way of compensation since it would be wrong to reinstate. 
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The grievor in his appearance before us does not present as one who is able or 
prepared to listen and abide suggestions for improvement and based on the 
evidence before us it would not be in the best interests of the student to place him 
in a classroom. 


After reading the arbitration decision, the Staffing Superintendent concluded that it was 
inappropriate to continue the complainant’s long-term occasional assignment or to keep his name 
on the Board’s occasional teacher list. 


The complainant received a letter dated January 11, 1993, from the Board’s Staffing 
Superintendent. The letter stated: 


I have recently become aware of an arbitration decision confirming the actions of 
the (named school board) in terminating your contract for unsatisfactory teaching 
performance. 


The Chair of the Arbitration Board concluded "it would not be in the best 
interests of the students to place him in a classroom". The [Board] concurs with 
this judgement; accordingly I am not prepared to employ you as an occasional 
teacher. Had this information been made available to the Board earlier, you 
would have not been accepted on our long-term occasional teacher list, and of 
course, would not have been an acceptable applicant for a long-term occasional 
assignment. : 

Accordingly, your long-term occasional assignment at [named school] is hereby 
terminated, effective today, and your name is hereby removed from our list of 
occasional teachers. 


The complainant believed that his privacy had been breached when the Board collected 
information about him from the arbitration decision, and used it to terminate his contract and 
remove his name from its list of occasional teachers. In his view, the information had been 
obtained surreptitiously, and had been used without his authorization. He was also concerned 
that medical information in the arbitration decision had been used by the Board in making its 
decisions. He stated that he had worked for the Board since 1989 as an occasional teacher, with 
excellent performance reports. 


The Staffing Superintendent stated that she had not taken any medical information from the 
arbitration decision into account in making the termination decision. Although she had 
considered the complainant’s satisfactory performance reviews, her decision had been influenced 
most by the statement in the arbitration decision that, "it was not in the best interests of the 
students to place him in the classroom". 
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Issues Arising from the Investigation 


(A) Did the arbitration decision contain the complainant’s "personal information" as 
defined in section 2(1) of the Act? 


(B) Did section 27 of the Act apply to the record of the arbitration decision? 


(C) Was the personal information collected in accordance with section 28(2) of the 
Act? 


(D) Was the personal information collected in accordance with section 29(1) of the 
Act? 


(E) Did the Board provide proper notice for the collection of the personal information 
in accordance with section 29(2) of the Act? 


(F) Was the personal information used in accordance with section 31 of the Act? 


In its response to our draft report, the Board raised an additional issue by requesting that the 
compliance investigation process be stayed pending the conclusion of grievance/arbitration 
proceedings concerning the Board’s decisions to terminate the complainant’s long-term 
occasional teaching assignment and remove his name from its list of occasional teachers. 


In making its request, the Board cited several reasons including: the prejudicial effect that our 
report might have on the grievance/arbitration proceeding; the principle that multiple legal 
proceedings ought to be discouraged; section 9 of the Ontario Evidence Act; and the “tenor” of 
our investigation reports. 


We have carefully considered the Board’s request but are not persuaded that a stay is warranted 
in the circumstances of this case, for the following reasons: 


First, although the privacy investigation and grievance arbitration proceedings arise from similar 
facts, they do not address the same issues. Our investigation addresses whether the Board has 
complied with the privacy protection provisions of the Act, while the grievance/arbitration is 
concerned with whether the Board acted appropriately, in accordance with its collective 
agreement, in terminating the complainant’s long-term occasional teaching assignment and 
removing his name from its list of occasional teachers. 


Secondly, our investigation report and the recommendations it contains are not binding on the 


decision maker in the arbitration. The investigation report simply sets out our views on whether 
the Board had complied with the privacy protection provisions of the Act. 
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Section 9 of the Ontario Evidence Act provides a witness who gives an answer in one proceeding 
protection against that answer being used or received in evidence in a subsequent proceeding, 
if he has objected to answering the question because it might tend to incriminate him, or tend 
to establish his liability in a civil proceeding. Even assuming that the Ontario Evidence Act 
applies to our investigation report, we are unable to see how it supports the granting of a stay 
in the circumstances of this particular case. 


Finally, in our view, the Board has failed to demonstrate specifically how its position in the 
arbitration would be prejudiced by the issuance of our final report. Therefore, after considering 
all of the circumstances, including the complainant’s interest in an expeditious resolution of his 
privacy complaint, we are not satisfied that a stay is warranted. 


RESULTS OF THE INVESTIGATION 


Issue A: Did the arbitration decision contain the complainant’s "personal 
information", as defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, but not limited to: 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, 


(e) the personal opinions or views of the individual except if they relate to 
another individual, 


(g) the views or opinions of another individual about the individual, and 


(h) — the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual 
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In our view, the arbitration decision contained the complainant’s "personal information" as 
defined in paragraphs (b),(e),(g), and (h) of the definition of personal information in section 2(1) 
of the Act. 


Conclusion: The arbitration decision contained the complainant’s "personal 
information" as defined in section 2(1) of the Act. 


Issue B: Did section 27 of the Act apply to the record of the arbitration decision? 
Section 27 of the Act states: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


In other words, the privacy provisions of Part II of the Act do not apply to personal information 
that is maintained for the purpose of creating a record that is available to the general public. 


The Freedom of Information and Protection of Privacy Act (the provincial Act) contains an 
equivalent provision, which is expressed in identical terms (section 37 of the provincial Act). 


It is our view that personal information maintained by an institution may be excluded from the 
application of Part II of the Act and Part III of the provincial Act only if the personal 
information is maintained by that institution for the purpose of creating a record which is 
available to the general public. Other institutions cannot claim the benefit of the exclusion for 
the same personal information, unless they, too, maintain the personal information for the 
purpose of making it available to the general public. 


The Board, in response to our draft report, noted that the above interpretation is somewhat 
different from the interpretation contained in earlier privacy investigations dealing with section 
27. While recognizing that consistency is an important goal, we also believe that the process 
of interpreting and applying a statute is not a static exercise. Privacy protection is a 
continuously evolving field. In our view, it is important not to take a rigid approach to this 
legislation. Over time, as we have the chance to apply the Act in a variety of factual situations, 
we may refine and sometimes reconsider earlier positions in order to meet the changing needs 
of our information society. 


Section 27 is a case in point. In our view, the narrower interpretation set out in this report is 
not only reasonable but also more in keeping with one of the fundamental goals of the Act -- 
namely, "to protect the privacy of individuals with respect to personal information about 
themselves held by institutions". 
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In the circumstances of this case, the record in question is an arbitration decision made under 
the School Boards and Teachers Collective Negotiations Act. We found that the Education 
Relations Commission (the ERC), which is an institution under the provincial Act, maintains a 
library of copies of arbitration decisions made under the School Boards and Teachers Collective 
Negotiations Act, and makes these decisions available to the public. The ERC’s library is 
available to members of the public who visit its offices, and summaries of arbitration decisions 
are routinely forwarded to school boards and teaching federations. In our view, arbitration 
decisions are the type of public record contemplated in section 37 of the provincial Act. 
Therefore, in disclosing the arbitration records, the ERC may rely on section 37 to exclude them 
from falling under the privacy provisions of Part III of the provincial Act. 


However, the Board collected the personal information in the record of the arbitration decision 
with a specific individual in mind (the complainant), for the purpose of furthering its reference 
check on the complainant. The Board’s purpose was not to create a record that was available 
to the general public. Therefore, it is our view that the Board could not rely on section 27 to 
exclude the arbitration record from the privacy provisions of Part II of the Act. 


Conclusion: Section 27 of the Act did not apply to the record of the arbitration 
decision. 


Issue C: Was the personal information collected in accordance with section 28(2) of 
the Act? 


Section 28(2) of the Act prohibits the collection of personal information unless one of three 
conditions exist. This section states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity [emphasis added]. 


The Board’s authority to appoint qualified teachers for schools that it operates is set out in 
section 170(12) of the Education Act. Collecting personal information during job competitions 
and subsequent reference checks affords the Board the opportunity to assess the qualifications 
of the candidates and verify the candidates’ experience and qualifications. In our view, 
collecting personal information for job competitions and subsequent reference checks is 
necessary in order for the Board to properly administer its lawfully authorized activity of hiring 
qualified teachers to fill available positions. Therefore, we conclude that the Board’s collection 
was necessary to the proper administration of a lawfully authorized activity, and was in 
accordance with section 28(2) of the Act. 
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Conclusion: The Board collected the complainant’s personal information in accordance 
with section 28(2) of the Act. 


Issue D: Was the personal information collected in accordance with section 29(1) of 
the Act? 


Section 29(1) of the Act prohibits an institution from collecting personal information other than 
directly from the individual unless certain conditions are met. This section states in part: 


(1) An institution shall collect personal information only directly from the individual to 
whom the information relates unless, 


(a) the individual authorizes another manner of collection; 


(b) the personal information may be disclosed to the institution 
concerned under section 32 or under section 42 of the Freedom of 
Information and Protection of Privacy Act, 1987; 


Although the complainant had given the Board verbal authorization to collect information about 
him from his referees, he had not authorized the Board to collect his personal information from 
‘the arbitration record. Since the complainant had not authorized another manner of collection, 
paragraph (a) did not apply. 


Paragraph (b) provides that personal information may be collected from a source other than the 
individual if the information may be disclosed to the institution under section 42 of the provincial 
Act. In order for the Board to be able to collect the personal information from the ERC, the 
ERC would have had to be able to disclose the personal information to the Board under section 
42 of the provincial Act. 


We have noted in the discussion of Issue B above, that in our view, section 37 of the provincial 
Act excludes records of arbitration decisions maintained by the ERC from the application of Part 
Ill of the provincial Act, including the restrictions on disclosure set out in section 42. 
Therefore, the ERC’s disclosure of the personal information in the record of the arbitration 
decision could not contravene the restrictions on disclosure set out in section 42. The ERC is 
permitted to disclose the information to the Board since the ERC is maintaining the personal 
information for the purpose of creating a record available to the general public. 


In our view, as the ERC’s disclosure of the arbitration decisions did not contravene section 42, 
the disclosure can be said, for the purposes of section 29(1)(b) of the Act, to be a disclosure that 
may be made under section 42 of the provincial Act. Therefore, the collection of the personal 
information by the Board was made in accordance with section 29(1) of the Act. 
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Conclusion: The collection was made in accordance with section 29(1) of the Act. | 


Issue E: Did the Board provide proper notice for the collection of the personal 
information in accordance with section 29(2) of the Act? 


Section 29(2) of the Act provides that if personal information is collected on behalf of an 
institution, the head shall inform the individual to whom the information relates of, 


(a) the legal authority for the collection; 


(b) the principal purpose or purposes for which the personal 
information is intended to be used; and 


(c) the title, business address and business telephone number of an 
officer or employee of the institution who can answer the 
individual’s questions about the collection. 


In response to the question of whether the Board had provided notice for the collection of the 
personal information for the job competition and subsequent reference checks, the Board stated 
that notice had been provided on the job posting, and drew our attention to the wording at the 
bottom of the posting, which stated: 


Confidentiality: personal information provided by applicants will be used for the 
purpose of this competition only and will be protected in accordance with the 
Municipal Freedom of Information and Protection of Privacy Act. 


We found that the above statement does not contain all the elements set out in section 29(2). 
There is no reference to the Board’s legal authority to collect the personal information, or to the 
title, business address, and business telephone number of an individual who could answer an 
individual’s questions about the collection. The purpose of the collection is stated in a limited 
manner (i.e. for the purpose of this competition only). Therefore, in our view, the Board did 
not provide proper notice in accordance with section 29(2) of the Act for the collection of 
personal information for the job competition and subsequent reference checks. 


Conclusion: The Board did not provide proper notice for the collection of personal 
information in accordance with section 29(2) of the Act. 
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) Issue F: Was the personal information used in accordance with section 31 of the Act? 


Section 31 of the Act sets out the conditions under which personal information may be used by 
an institution. It states: 


An institution shall not use personal information in its custody or under its control 
except, 


(a) if the person to whom the information relates has identified that 
information in particular and consented to its use; 


(b) for the purpose for which it was obtained or compiled or for a 
consistent purpose; or 


(c) for a purpose for which the information may be disclosed to the 
institution under section 32 or under section 42 of the Freedom of 
Information and Protection of Privacy Act, 1987. 


The Board’s position was that it had used the personal information it collected for a consistent 
purpose, in accordance with section 31(b) of the Act, when it used the information to 1) remove 

4 the complainant’s name from the Board’s list of occasional teachers, and 2) terminate the 
complainant’s long-term occasional contract. Section 33 of the Act states: 


The purpose of a use or disclosure of personal information that has been 
collected directly from the individual to whom the information relates is a 
consistent purpose under clauses 31 (b) and 32 (c) only if the individual might 
reasonably have expected such a use or disclosure [emphasis added]. 


In this case, the personal information at issue was not collected directly from the complainant; 
it was collected indirectly from the record of the arbitration decision the Board had obtained. 
Accordingly, the question of whether the use was for a consistent purpose could not be 
determined by the complainant’s reasonable expectation. In our view, in cases such as this, 
where personal information is collected indirectly, the question of whether the use was for a 
consistent purpose should be determined by considering whether the Board’s use of the personal 
information was reasonably compatible with the purpose for which it was collected. 


In response to our draft report, the Board stated that it did not necessarily disagree with the view 
taken above. However, the Board raised the issue of whether we had applied an "identical" 
purpose test, rather than a consistent purpose test in the circumstances of this complaint (i.e. that 
we had interpreted a "consistent" purpose as being an "identical" purpose). The result of using 
such an interpretation would be that unless the use of the information was identical to the 
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intended purpose stated in the notice, the use would not be reasonably compatible with the 
original purpose; the use would not then be for a consistent purpose, and would contravene the 
Act. 


Use 1) In our draft report, when setting out our conclusion as to whether the personal 
information in the arbitration decision had been used for a purpose that was reasonably 
compatible with the original purpose for the collection, we stated, 


In our view, this use was not reasonably compatible with the purpose identified 
by the Board in its notice of collection because [emphasis added] it extended 
beyond the very narrow use contemplated in the notice. 


Since the above wording has apparently resulted in some misunderstanding, we wish to clarify 
our position as follows: 


Generally speaking, the fact that a use of personal information may extend beyond the intended 
use set out in a notice of collection would not, in itself, be cause for finding that it was not 
reasonably compatible with the intended purpose. As the Board has noted, the Act includes 
provisions for the use of personal information for a consistent purpose, which would not be 
identical to the intended purpose for the collection. Our reasons for finding that a use is or is 
not reasonably compatible with the intended purpose are based on the specific circumstances of 
each case. 


In this particular case, the Board conducted a job competition for a specific position. The use 
described in the notice was "for the purpose of this competition only". The Board explained to 
us that this notice applied to the collection of reference information, which therefore included 
the arbitration decision. Our understanding of the Board’s intent at the time the notice was 
provided was that there was to be one, and only one use for the collection -- for the purpose of 
the job competition. However, the Board used the information contained in the arbitration 
record to make a decision to remove the complainant’s name from its list of occasional teachers 
(unrelated to this competition), and effectively terminate his employment with the Board. 


In our view, by using the word “only” in its notice, the Board was giving assurance to all job 
candidates that the personal information to be collected would be used for a specific, limited 
purpose (the job competition). Accordingly, it is our view that the word “only” in the notice 
was meant to be taken literally -- and we have done so. Thus, after considering the above 
. circumstances, it is our view that using the personal information for the purpose of removing 
the complainant’s name from the list of occasional teachers would be not be reasonably 
compatible with the purpose stated in the notice. In light of the fact that we did not consider 
the use of the personal information to be reasonably compatible with the purpose for which it 
was collected, we conclude that the personal information was not used in accordance with section 
31(b) of the Act when the Board used it for a purpose other than the competition (i.e. to remove 
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the complainant’s name from its list of occasional teachers, thereby terminating his 
employment). 


Use 2) It is our view that when the Board terminated the complainant’s long-term contract, 
which he was awarded as a result of the competition, it used the personal information for the 
purpose for which it was obtained (i.e. to make a decision about the successful candidate in the 
competition). Therefore, it is our view that the Board used the personal information in 
accordance with section 31(b) of the Act when it made its decision to terminate the long-term 
contract of the complainant. 


Conclusions: Use 1) The personal information was not used in accordance with section 
31(b) of the Act when the Board used it to remove the complainant’s name 
from its list of occasional teachers. 


Use 2) The personal information was used in accordance with section 
31(b) of the Act when the Board used it to terminate the complainant’s 
long-term contract. 


Other Matters 


We wish to draw attention to the following matters: 


The complainant was concerned that his medical information might have been used by the Board 
in making its decision concerning his employment. Although we are aware that the arbitration 
decision contained medical information about the complainant, we could find no evidence to 
support the complainant’s view that the information had actually been used in making the 
decision to terminate. We concluded that on the balance of probabilities, the complainant’s 
medical information had not been used by the Board, and therefore, we did not include this item 
as an issue to address in this report. 


The Board asked the complainant to provide the names of referees that the Board could contact 
for reference purposes. However, the Board collected the complainant’s personal information 
from a different source (the arbitration decision), without his knowledge. The complainant’s 
view of this was that his personal information had been collected surreptitiously. However, it 
is our understanding that it is not the Board’s practice to search public records for information 
about job candidates without their knowledge. In this case, it was only after the Board became 
aware of the arbitration decision, that it decided to obtain a copy of it. In future, if a similar 
situation arises, we suggest that in the spirit of the Act, the Board advise the individual that it 
has become aware of an arbitration decision (or other public record) about him or her, and 
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intends to collect it and use the information contained therein. However, the Board should be 
aware that proper notice must also be given in accordance with section 29(2) of the Act. 


The Board referred to the notice previously discussed in Issue E of this report when asked if 
notice was provided for the job competition and subsequent reference checks. The Board’s 
notice stated that "personal information provided by applicants will be used for the purposes of 
this competition only". In our view, the wording of this notice is very narrow. It does not 
appear to contemplate that information collected might be used for a purpose other than the job 
competition involved, nor does it appear to contemplate that information that may be collected 
indirectly, during the course of reference checks. In determining whether the Act had been 
contravened, we relied on the wording of the Board’s notice to determine the Board’s intent with 
regard to the use of the personal information collected for the job competition. Similarly, 
individuals whose personal information is being collected would also rely on the wording of the 
Board’s notice to advise them of how their personal information will be used by the Board. 
Therefore, we wish to stress the importance of the wording contained in a notice of collection 
regarding the intended use(s) of the personal information collected. 


For the purposes of this investigation, we have taken the view that the candidate, in giving the 
Board the names of his referees, was authorizing the indirect collection of his personal 
information regarding his reference checks. However, the Board had no record to show that the 
indirect collection of reference information had actually been authorized by the complainant, 
other than on a page of notebook paper, where information about the referees was written. This 
page did not contain the complainant’s name, signature, date, or any other information to 
support the Board’s position that the indirect collection had been authorized by the complainant. 
In our view, the Board’s current method of obtaining authorization should be strengthened to 
provide greater support regarding authorizations for the indirect collection of reference 
information. 


The Board had also spoken with an individual who was not one of the referees named by the 
complainant to ask if anyone at that person’s board could provide a reference for the 
complainant. Since we have taken the view that the complainant had authorized the Board to 
contact the individuals in question when he gave the Board their names, we also take the view 
that the complainant’s authorization was limited to those individuals, and did not extend to 
individuals whose names he had not provided. The Board should be aware that collecting the 
complainant’s personal information from an individual other than the named referees, 
contravenes section 29(1) of the Act. 


SUMMARY OF CONCLUSIONS 


° The arbitration decision contained the complainant’s personal information, as defined in 
section 2(1) of the Act. 
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Section 27 of the Act did not apply to the record of the arbitration decision. 


The Board collected the complainant’s personal information in accordance with section 
28(2) of the Act. 


The collection was made in accordance with section 29(1) of the Act. 
The Board did not provide proper notice for the collection of personal information for 
the job competition and subsequent reference checks in accordance with section 29(2) of 


the Act. 


The personal information was not used in accordance with section 31(b) of the Act when 
the Board used it to remove the complainant’s name from its list of occasional teachers. 


The personal information was used in accordance with section 31(b) of the Act when the 
Board used it to terminate the complainant’s long-term contract. 


RECOMMENDATIONS 


We recommend that the Board incorporate the following points into its procedures: 


L 


that proper notice for the collection of personal information be provided by the Board 
when it conducts job competitions and reference checks associated with the competition. 


that proper notice be provided by the Board to individuals if it collects personal 
information about them from public records. 


that written authorization be obtained by the Board from job candidates to contact 
individual referees and that the Board restrict itself to collecting reference information 
only from those referees it has been authorized to contact. 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner/Ontario with proof of compliance with the above 


recommendations. 
Original signed by: August 11, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a Regional Police Service 
(the Police). 


The complainant filed a complaint with the Police’s internal Investigation Unit which handles 
public complaints against police personnel. During the course of investigating the complaint, 
two investigating officers met with the complainant. The complainant stated that in this meeting 
the investigating officers indicated that they knew she had made a request for access to 
information (access request) under the Municipal Freedom of Information and Protection of 
Privacy Act (the Act), and the details of that request. The complainant stated that this 
information must have been disclosed to and by these two officers, contrary to the Act. 
However, apart from the two officers, the complainant was not able to specifically identify the 
parties involved. 


_ In addition, the complainant learned that five individuals with the Police had received a copy of 
her access request. The complainant has submitted that these five individuals (whom she 
identified as three police personnel and two superintendents) disclosed her personal information 
to other individuals either within or outside of the Police, contrary to the Act. 


Issues Arising from the investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? 


(B) Was the personal information disclosed to the investigating officers by the Police 
and, if so, was the disclosure in accordance with section 32 of the Act? 


(C) | Was the personal information disclosed by the investigating officers to any other 
individual, and, if so, was this disclosure in accordance with section 32 of the 
Act? 


(D) Was the personal information disclosed by the five individuals identified by the 


complainant, and, if so, was the disclosure in accordance with section 32 of the 
Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information” as defined in section 2(1) 
of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(d) the address, telephone number, symbol or other particular assigned 
to the individual, 


(h) the individual’s name if it appears with some other personal 
information relating to the individual or where the disclosure of the 
name would reveal other personal information about the individual; 


The information in question is the fact that the complainant filed an access request with the 
Police and the details of the access request. The access request contained her name, address, 
and telephone number. In our view, this information meets the requirements in paragraph (d) 
and (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the personal information disclosed to the investigating officers by the Police 
and, if so, was the disclosure in accordance with section 32 of the Act? 


According to the Police, when the complainant filed the complaint against the Police, she 
provided material that, to the investigating officers’ knowledge, could only have been obtained 
through an access request under the Act. This material included a partial transcript of a police 
dispatch recording. 


The Police informed us that while investigating the complainant’s complaint against the Police, 
the investigating officers interviewed the complainant. During the course of this interview 
several items were discussed including the information that the complainant had filed with her 
complaint, and her access request. One of the investigating officers stated that, in these 
discussions, the complainant advised that she had made an access request under the Act. He also 
stated that the complainant was upset that some questions he asked of her related to information 
that she had not received under her access request. 
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The Police maintained that the investigating officers became aware that the complainant had 
made an access request based upon the material filed by the complainant when she made her 
complaint, and not through a disclosure of the access request itself by the Police. 


Having considered the information provided by the Police and the complainant, we are of the 
view that the two investigating officers learned that the complainant had filed an access request 
based upon their consideration of the material filed with the complaint and the information under 
discussion during the interview with her. In our view, the Police did not disclose the access 
request itself to the investigating officers. 


Conclusion: The personal information was not disclosed to the investigating officers by 
the Police. 


Issue C: Was the personal information disclosed by the investigating officers to any other 
individual, and, if so, was this disclosure in accordance with section 32 of the 
Act? 


The complainant has questioned whether the investigating officers disclosed her personal 
information to any other individual. 


- The Police have informed us that the investigating officers disclosed the complainant’s personal 
information to their direct Supervisor. However, this disclosure was limited to the fact that the 
complainant had filed an access request. It did not include details of the access request itself. 
The Police have stated that the officers and the Supervisor did not disclose this information to 
anyone else. : 


The Police have relied upon section 32(d) of the Act for this disclosure. This section states: 


An institution shall not disclose personal information in its custody or under its control 
except, 


(d) if the disclosure is made to an officer or employee of the 
institution who needs the record in the performance of his or her 
duties and if the disclosure is necessary and proper in the 
discharge of the institution’s functions; 


The Police informed us that the investigating officers’ Supervisor had the responsibility of 
ensuring that his staff thoroughly investigated all public complaints. Based upon these 
investigations, the Supervisor must make a formal recommendation to the Chief of Police as to 
whether a member of the Police should be disciplined. Therefore, the Police maintained that 
the Supervisor must be aware of all circumstances surrounding an investigation. The Police 
submitted that section 32(d) of the Act applied. 
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It is our view that conducting investigations of complaints against the Police, as set out in Part 
VI of the Police Services Act, is a function of the institution. In our view, the Supervisor 
needed all of the information related to the complaint investigation in the performance of his 
duty of ensuring thorough investigations of complaints and determining matters of discipline. 
This information would include the fact that the complainant had made an access request to 
obtain some of the material she filed with her complaint against the Police. In our view, this 
disclosure was to a Police officer who needed the record in the performance of his duties and 
was necessary and proper in the discharge of one of the Police’s functions. Therefore, the 
disclosure was in accordance with section 32(d) of the Act. 


Conclusion: The personal information was disclosed to the investigating officers’ 
Supervisor in accordance with section 32(d) of the Act. 


Issue D: Was the personal information disclosed by the five individuals identified by the 
complainant, and, if so, was the disclosure in accordance with section 32 of the 
Act? 


The complainant did not provide any evidence to substantiate her claim that the five individuals 
(who she identified as three police personnel and two superintendents) disclosed her personal 
information to other individuals either within or outside of the Police. 


The Police contacted the police personnel and the superintendents to determine if they had 
disclosed the complainant’s personal information to any other individual. Of these five 
individuals, four stated that they had not disclosed the complainant’s personal information to 
anyone else. However, one superintendent informed the Police that he had provided an 
inspector, who was the immediate supervisor of one of the five individuals, with a copy of the 
complainant’s access request, for the purpose of instructing that inspector to obtain the necessary 
records for the access request. The superintendent did not disclose the personal information to 
anyone other than this inspector. The Police also informed us that the inspector did not disclose 
the personal information to anyone other than to the individual under his supervision. 


We have reviewed section 32 of the Act and, in our view, none of the provisions apply to the 
disclosure of the access request. The Police have acknowledged that there was no need to 
disclose the complainant’s access request, in its entirety, to the inspector. The Police no longer 
distribute a copy of the access request when requesting records. Instead, the relevant Police 
personnel are advised that an access request has been received and that certain records are 
required. 


Conclusion: One of the five individuals identified by the complainant disclosed the 


complainant’s personal information to an inspector, contrary to section 32 
of the Act. 
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SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. ; 

e The personal information was not disclosed to the investigating officers by the Police. 

* The personal information was disclosed to the investigating officers’ Supervisor in 


accordance with section 32(d) of the Act. 


e One of the five individuals identified by. the complainant disclosed the complainant’s 
personal information to an inspector, contrary to section 32 of the Act. 


RECOMMENDATIONS 


Since the Police have already implemented changes in the manner in which access requests are 
processed, we do not think it is necessary to make any further recommendations. 


Original signed by: July 21,1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Community 
and Social Services (the Ministry). ; 


An employee at one of the Ministry facilities complained to the Information and Privacy 
Commissioner/Ontario that the Ministry had improperly disclosed his personal information. 
According to the complainant, in August 1992 he had written to the Executive Assistant (the EA) 
of the Ministry’s Southwest Regional Office and had enclosed a number of documents with the 
letter (the records). In the letter, the complainant had made a number of allegations regarding 
his treatment by various staff at the facility. The complainant stated that he had asked the EA 
not to send the records or show them to anyone else. According to the complainant, he had 
telephoned the EA about four days after he had delivered the records to inquire whether the EA 
intended to conduct an investigation based on the additional information contained in the records. 
The EA had advised him that he did not plan to conduct an investigation but that he had sent 
the records to the Acting Administrator at the facility (the Administrator). It was the 
complainant’s view that the EA had disclosed his personal information contrary to the provisions 


of the Freedom of Information and Protection of Privacy Act (the Act). 


Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


A. Was the information in question "personal information" as defined in section 2(1) 
of the Act? 
B. If yes, was the disclosure of the personal information in accordance with section 


42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A. Was the information "personal information" as defined in section 2(1) of the 
Act? 


Section 2(1) of the Act states, in part: 
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"personal information" means recorded information about an identifiable 
individual, including, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


We have reviewed copies of the records. They identified the complainant by name and 
contained information which satisfied the requirements of paragraphs (d) and (h) of the definition 
of "personal information" in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in section 2(1) 
of the Act. 


Issue B. Was the disclosure of the personal information in accordance with section 42 
of the Act? 


According to the Ministry, the complainant had telephoned the Regional Office in July 1992, and 
had made a number of allegations regarding his employment at the facility. The complainant 
had spoken to the EA who had discussed the allegations with the acting Regional Director and 
the matter had then been referred to the Administrator. The Administrator had investigated the 
complainant’s allegations and had advised the complainant of the results of the investigation by 
letter, dated July 31, 1992. During the course of the investigation, the complainant had been 
advised that the investigation resulted from the telephone call he had made to the EA at the 
Southwest Regional Office. 


The Ministry stated that on August 10, 1992, the complainant visited the Regional Office and 
left an envelope addressed to the EA, marked "confidential" and with the words, "Investigate 
this", written on it. The envelope contained the records which appeared to the EA to be related 
to the matter that the complainant had complained about in July, therefore he sent the records 
to the Administrator. 


[IPC Investigation 193-012P/June 15, 1993] 


me 2 ts 


The Ministry stated that the complainant telephoned the EA on August 11, 1992, and asked the 
EA if he had read the material. The complainant repeated in general terms the allegations he 
had made in July and the EA advised the complainant to take up the matter with the 
Administrator. The complainant again telephoned the EA on October 13, 1992, and asked the 
EA about the records. The EA advised him that he had sent the records to the Administrator. 
The complainant then advised the EA that if he had wanted the Administrator to see the records, 
he would have sent them directly to the Administrator. 


According to Ministry, in the EA’s judgement, the records were related to the complainant’s 
previous allegations about his employment at the facility. There was no indication that the 
records were not to be sent to the Administrator. The envelope was addressed to the EA, and 
marked "confidential" and had the words, "Investigate this", written on it. Therefore, the EA 
sent: the records to the Administrator who had been responsible for the investigation of the 
complainant’s previous allegations. The Ministry has stated that it relied on section 42(d) of the 
Act for sending the records to the Administrator. 


Section 42(d) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) where disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and where 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


One of the Ministry’s functions includes the supervision and management of its employees. 
Therefore, the Ministry had an obligation to investigate the allegations made by the complainant 
concerning his treatment by other staff. In order to conduct a proper investigation, the Ministry 
had to gather all the relevant evidence. As part of his duties, the Administrator had been 
responsible for the investigation of the complainant’s previous allegations. The records appeared 
to the EA to be related to this previous investigation, therefore, he forwarded the records to the 
Administrator. In our view, the disclosure of the records to the Administrator was to an officer 
of the Ministry who needed them in the performance of his duties and was necessary and proper 
in the discharge of Ministry’s functions. Therefore, the disclosure was in accordance with 
section 42(d) of the Act. 


Conclusion: The disclosure of the complainant’s personal information was in accordance with 
section 42(d) of the Act. 
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SUMMARY OF CONCLUSIONS 


i) The information in question was "personal information" as defined in section 2(1) of the 
Act. 
0 The disclosure of the complainant’s personal information was in accordance_with section 


42(d) of the Act. 


Original signed by June 15, 1993 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named Municipality (the 
Municipality). 


The complainant, an employee of the Municipality’s licensing commission, was a Workers’ 
Compensation Board (WCB) claimant, and a recipient of long-term disability (LTD) benefits 
from the Municipality. Her complaint was that embarrassing medical information about herself, 
contained in a WCB Decision Review Specialist’s Report (the Report) had been disclosed by the 
Municipality to a named insurance company and to non-medical staff at the licensing 


commission, contrary to the Municipal Freedom of Information and Protection of Privacy Act 
(the Act). 


The complainant advised that she had not given her consent for disclosure of the Report to the 
insurance company or to licensing commission staff. The complainant maintained that when she 
had worked for the licensing commission, she had seen similar reports herself, and was aware 
that no medical personnel were employed by the licensing commission. In the complainant’s 
view, licensing commission staff should not have had access to her sensitive medical 
information. 


The complainant also contended that the Report was improperly disclosed at an arbitration 


hearing arising from grievances she had filed against the Municipality, relating to WCB 
payments she had received from the Municipality, pending the Report’s decision. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information contairied in the Report "personal information" as defined 
in section 2(1) of the Act? If yes, 


(B) Did the Municipality disclose the personal information to the licensing 
commission, in accordance with section 32 of the Act? 


(C) Did the Municipality disclose the personal information to the insurance company, 
in accordance with section 32 .of the Act? 


(D) Did the Municipality disclose the personal information at the arbitration hearing 
in accordance with section 32 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information contained in the Report "personal information" as 
defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, (emphasis added) 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


We reviewed the Report and found that it contained the complainant’s medical history. We also 
noted that it contained information concerning the WCB advances paid to the complainant by the 
Municipality, and references from physicians and other specialists related to workplace 
accommodation to address the complainant’s physical limitations. 


In our view, the information in the Report met the requirements of paragraphs (b) and (h) of the 
definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information contained in the Report was personal information, as 
defined in section 2(1) of the Act. 
Issue B: Did the Municipality disclose the personal information to the licensing 
commission, in accordance with section 32 of the Act? 
The complainant’s concern centred on the disclosure of the Report to non-medical staff at the 
licensing commission. The complainant felt that the licensing commission only needed to know 


whether her WCB claim had been approved or denied. 


Under the Act, an institution shall not disclose personal information in its custody or under its 
control, except in the circumstances outlined in section 32. 


The Ministry stated that its treasury department had disclosed the Report to the licensing 
commission, which functions as a department of the Municipality in its relationship to other 
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departments. It was thus the Municipality’s view that the disclosure had been internal to the 
Municipality, and was in accordance with section 32(d) of the Act, i.e., disclosure to an officer 
or employee of the institution who needed the record in the performance of his or her duties. 


However, for the purposes of the Act, the licensing commission is considered to be a separate 
institution from the Municipality. Therefore, we examined the application of section 32(c) of 
the Act to the Municipality’s disclosure to the licensing commission. This section states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


The Municipality advised that its treasury department had obtained the Report from the WCB 
for administrative purposes including computer updating of claims information and for 
distribution to the affected "department", in this case, the licensing commission. The licensing 
commission was responsible for WCB claims management which included payroll recording and 
the payments of benefits. The Municipality stated that the Accounting Supervisor and the 
Payroll Clerk had access to the Report in order to perform their administrative duties related to 
claims management. The Report was also disclosed to the Director of Administration in order 
_to respond to questions directed to him from the complainant. 


The Municipality also advised that such WCB reports generally included information related to 
"prognosis, re-training and rehabilitation, workplace accommodation requirements and any other 
factors which are relevant". The affected "department" assesses a report’s decision to help 
determine whether an appeal should be filed with the WCB and to respond to the issues 
addressed in the report, such as workplace accommodation etc. . 


It is our view that in this case, one of the purposes for which the Municipality (the treasury 
department) had collected the Report was for claims administration including computer updating 
of WCB claims information. The Municipality then disclosed the Report to the staff of the 
affected "department" -- the licensing commission, for WCB claims management which included 
payroll recording, payments of benefits and assessment purposes. 


Section 33 of the Act states: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. 
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However, when personal information has been collected indirectly, as in the circumstances of 
this case, a "consistent purpose" is one which is "reasonably compatible" with the purpose for 
which the information was obtained or collected. In our view the Municipality disclosed the 
Report to the licensing commission for purposes which were reasonably compatible with the 
purpose for which the Municipality had obtained it. Therefore, the Municipality’s disclosure 
to the licensing commission was for a consistent purpose, in accordance with section 32(c) of 
the Act. 


Conclusion: The Municipality’s disclosure of the complainant’s personal information 
to the licensing commission was in accordance with section 32 of the Act. 


Issue C: Did the Municipality disclose the personal information to the insurance 
company, in accordance with section 32 of the Act? 


The Report contained medical information about the complainant as well as details such as the 
amount of WCB advances paid to the complainant. The complainant contended that the 
Municipality had no right to disclose the medical information contained in the Report to the 
insurance company without her consent. The complainant explained that forms sent to her by 
the insurance company often contain a waiver concerning disclosure. She routinely crosses out 
such waivers, and had not consented to any disclosure to the insurance company. The 
complainant contended that if medical information had been required by the insurance company, 
it could have been obtained directly from herself, or the WCB. 


The Municipality stated that it had relied on section 32(c) of the Act for the disclosure of the 
Report to the insurance company i.e., for a consistent purpose. 


The Municipality acknowledged that it did not have the complainant’s specific consent for this 
disclosure. However, the Municipality advised that when a claim for Long Term Disability 
(LTD) is in place, as in the complainant’s case, relevant WCB correspondence to the employer 
regarding an employee’s benefits is disclosed to the insurance company for both administrative 
and "adjudicative" purposes. The Municipality advised that it pays the full amount of benefits, 
whether workers’ compensation or LTD. In the case of LTD benefits, the insurance company 
issues benefit cheques, but sends monthly invoices for the total amount paid to each individual 
to the Municipality. 


The Municipality stated that it has an "Administrative Services" contract with the insurance 
company which provides for "arms length adjudication" of long term disability claims. To 
appropriately grant or deny a claim is dependant on the insurance company receiving or 
collecting all the information necessary to make such a decision. As all claims rest on an 
individual’s medical condition, decisions cannot be made in the absence of such information. 
In the circumstances where an individual suffers a work-related injury for which workers’ 
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compensation benefits are paid, and an application for LTD benefits has also been made, proper 
adjudication requires accurate information about the nature of the injury or illness, the prognosis, 
any other factors which may affect the individual’s return to work, and his/her eligibility for 
either workers’ compensation benefits or LTD benefits. An individual is not entitled to both 
workers’ compensation benefits and LTD benefits. It is important that an individual receive the 
appropriate benefits since he/she may be required to participate in a WCB return to work 
program, when in reality they may not be able to do so and may be eligible for LTD benefits. 


The Municipality also believed that the most accurate information would be obtained from the 
records created at the time of the injury and during the subsequent claims and adjudication 
processes, and the resulting Decision Review Officer’s reports. These reports contain 
information provided by the applicant, physician(s) and other specialists. The Municipality 
submitted that in many cases, this information is sufficient to verify eligibility for LTD, in the 
event workers’ compensation benefits are terminated. The Municipality stated that in 
adjudicating the disability claim, the insurance company may decide to arrange for examination 
by an independent physician in addition to considering the Report. 


In the complainant’s case, her workers’ compensation benefits were terminated but she was 
awarded a lifelong pension for chronic pain by the WCB. It was determined by the insurance 
company that she was also entitled to full LTD benefits. The insurance company, therefore, 
used the Report to determine whether the complainant was eligible for LTD benefits and the 
level of those benefits. The insurance company confirmed that the medical information 
contained in the Report was used for these purposes. 


In our view, one of the purposes of the Municipality’s collection of the Report would have been 
to use the medical information it contained to determine if workers’ compensation benefits or 
LTD benefits were due to the complainant. The Municipality’s disclosure to its insurance 
company of the complainant’s medical information in the Report was to provide the insurance 
company with information so that it could determine, as per its agreement with the Municipality, _ 
the LTD benefits which were due to the complainant from the Municipality. In our view, the . 
Municipality’s disclosure of the medical information in the Report to the insurance company was 
for the same purpose for which the information had been collected. Therefore, the disclosure 
was in accordance with section 32(c) of the Act. 


Conclusion: The Municipality’s disclosure to the insurance company of the 


complainant’s personal information contained in the Report, was in 
accordance with section 32 of the Act. 


Issue D: Did the Municipality disclose the personal information at the arbitration 
hearing in accordance with section 32 of the Act? 
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The complainant contended that the Municipality had improperly disclosed the information 
contained in the Report at an arbitration hearing arising from grievances she had filed. She 
stated that the medical information in the Report was not deleted before it went to arbitration. 


The Municipality originally stated that it was its view that the disclosure was in accordance with 
section 32(c) of the Act, i.e. that it was for a consistent purpose. Its position was that the 
Report was disclosed at the arbitration hearing because it contained information directly related 
to two of the grievances filed by the complainant. 


However, the Municipality later stated that the lawyer who had represented the complainant at 
the arbitration hearing had had an opportunity to object to the introduction of the Report at the 
arbitration. We confirmed with the lawyer that this was the case. 


Section 32(b) of the Act states: 


An institution shall not disclose personal information in its custody or under its control 
except, 


(b) if the person to whom the information relates has identified that 
information in particular and consented to its disclosure; 


It is our view that the lawyer was acting as the complainant’s agent at the arbitration hearing. 
It is also our view that the complainant, through her agent, had identified the Report but had not 
objected (again through her agent) to the disclosure of the Report and its contents. In our view, 
the complainant’s implied consent was given to the Report’s disclosure at the arbitration hearing. 
The Municipality’s disclosure of her personal information in the Report was, therefore, in 
accordance with section 32(b) of the Act. 


Conclusion: The Municipality’s disclosure of the complainant’ s personal information 
at the arbitration hearing was in accordance with section 32 of the Act. 


Other Matters 


With respect to the security of the complainant’s personal information, the Municipality has 
advised us that all correspondence received from the WCB related to the management of claims 
is stored in locked cabinets in the treasury department and in the accounting/payroll section at 
the licensing commission. 


At the treasury department, access is restricted to staff responsible for managing the claims 
process. Access to the treasury department floor is controlled through a security card system. 
At the licensing commission, access is restricted to accounting/payroll staff; other staff may not 
enter this section without supervision by area staff. The section is also locked at night. 
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SUMMARY OF CONCLUSIONS 


e The information contained in the Report was personal information, as defined in section 
2(1) of the Act. 


e The Municipality’s disclosure of the complainant’s personal information to the licensing 
commission was in accordance with section 32 of the Act. 


e The Municipality’s disclosure to the insurance company of the complainant’s personal 
information in the Report was in accordance with section 32 of the Act. 


e The Municipality’s disclosure of the complainant’s personal information at the arbitration 
hearing was in accordance with section 32 of the Act. 


Original signed by: May 25, 1994 
Ann Cavoukian, Ph.D Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the Solicitor 
General and Correctional Services (the Ministry). ; 


In his letter of complaint, the complainant stated: 
After a visit to my Probation Officer (the named Probation Officer) my ex wife 
told my son that she had received a call from (the named Probation Officer) and 
she divulged information to her that his daddy wanted to kill all women. I want 
action taken on this matter as my rights have been VIOLATED. 

Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Freedom of Information and Protection of Privacy Act (the Act)? 


(B) Did the Ministry disclose the personal information, in accordance with section 42 
of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 


recorded information about an identifiable individual, including, 


(g) the views or opinions of another individual about the individual, and 
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In our view, if the Probation Officer was of the view or opinion that the complainant wanted to 
kill all women, this would constitute the complainant’s personal information, in accordance with 
paragraph (g) of the definition of personal information, in section 2(1) of the Act. 


Conclusion: If the Probation Officer was of the view or opinion that the complainant 
wanted to kill all women, this would constitute the complainant’s "personal information", 
as defined in section 2(1) of the Act. 


Issue B: Did the Ministry disclose the personal information, in accordance with section 
42 of the Act? 


Section 42 of the Act prohibits the disclosure of personal information by an institution, except 
in certain circumstances. (For the full text of section 42, please refer to Appendix A.) 


As previously mentioned, the complainant believed that the Probation Officer told his ex-wife 
that he wanted to kill all women. 


We contacted the Probation Officer. She denied that she told the complainant’s ex-wife that the 
complainant wanted to kill all women. . 


We also reviewed the documents in the complainant’s case supervision file, as they pertained 
to the Probation Officer’s supervision of the complainant. We found no evidence of the 
Probation Officer having made this statement. 


Conclusion: We found no evidence of the Probation Officer having disclosed the 
information, in question. 

SUMMARY OF CONCLUSIONS 

e If the Probation Officer was of the view or opinion that the complainant wanted to kill 


all women, this would constitute the complainant’s personal information, as defined in 
section 2(1) of the Act. 


e We found no evidence of the Probation Officer having disclosed the information, in 
question. 

Original signed by: July 16, 1993 

John J. Brans Date 


Manager of Compliance 
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APPENDIX A 


42. An institution shall not disclose personal information in its custody or under its control 
except, 


(a) in accordance with Part II; 


(b) where the person to whom the information relates has identified that information in 
particular and consented to its disclosure; 


(c) for the purpose for which it was obtained or compiled or for a consistent purpose; 


(d) where disclosure is made to an officer or employee of the institution who needs the 
record in the performance of his or her duties and where disclosure is necessary and 
proper in the discharge of the institution’s functions; 


(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament or 
a treaty, agreement or arrangement thereunder; 


(f) where disclosure is by a law enforcement institution, 


(i) to a law enforcement agency in a foreign country under an arrangement, a written 
agreement or treaty or legislative authority, or 


(ii) | to another law enforcement agency in Canada; 


(g) | where disclosure is to an institution or a law enforcement agency in Canada to aid an 
investigation undertaken with a view to a law enforcement proceeding or from which a 
law enforcement proceeding is likely to result; 


(h) in compelling circumstances affecting the health or safety of an individual if upon 
disclosure notification thereof is mailed to the last known address of the individual to 
whom the information relates; 


(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of 
an individual who is injured, ill or deceased; 


(j) to a member of the Legislative Assembly who has been authorized by a constituent to 
whom the information relates to make an inquiry on the constituent’s behalf or, where 
the constituent is incapacitated, has been authorized by the next of kin or legal 
representative of the constituent; 


(k) toa member of the bargaining agent who has been authorized by an employee to whom 
the information relates to make an inquiry on the employee’s behalf or, where the 
employee is incapacitated, has been authorized by the next-of-kin or legal representative 
of the employee; 
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(1) to the responsible minister; 
( 
(m) to the Information and Privacy Commissioner; and 


(n) to the Government of Canada in order to facilitate the auditing of shared cost programs. 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a municipal Board of 
Education (the Board). 


The complainant was of the view that his personal information had been improperly disclosed 
when the Board identified him and three other individuals in a newspaper article, as being part 
of a group responsible for filing the most freedom of information requests with the Board. 
These requests were for access to information under the Municipal Freedom of Information and 


Protection of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from this investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Board’s disclosure of the personal information to the newspaper, in 
accordance with the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal information 
relating to the individual... 


The complainant provided us with two newspaper articles dated February 6, 1993 and February 
10, 1993. In the February 6, 1993 article, the Board identified the complainant and three other 
individuals as being part of a group responsible for filing the most freedom of information 
requests with the Board. The second newspaper article dated February 10, 1993, reported on 
the complainant’s reaction to being named in the February 6, 1993 article. 


It is our view that the information in question met the requirements of paragraph (h) of the 
definition of personal information in section 2(1) of the Act. 
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Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Board’s disclosure of the personal information to the newspaper, in 
accordance with the Act? 


We determined that in an interview with a local newspaper reporter, the Chair of the Board and 
the Director of Education said that the Board had received a total of 247 freedom of information 
access requests during 1991 and 1992. They also told the reporter that these 247 requests had 
been made by a total of 27 people. The Board then identified four individuals by name, 
including the complainant, as part of a group that was responsible for filing the most access 
requests with the Board. This information appeared in the February 6, 1993, newspaper article. 


Under the Act, an institution may not disclose personal information in its custody or under its 
control except in the specific circumstances outlined in section 32. 


However, the Board has submitted that section 50(1) of the Act is applicable in the 
circumstances of this case, and that it is not necessary to rely on section 32 of the Act for the 
disclosure. Section 50 of the Act provides in part that: 


(1) If a head may give access to information under this Act, nothing in this Act 
prevents the head from giving access to that information in response to an oral 
request or in the absence of a request. 


The Board stated that if a formal access request had been made under Part I of the Act, 
disclosure of the personal information would not have constituted an "unjustified invasion of 
personal privacy" under section 14 of the Act. Thus, the head would have been obliged to 
provide access to the personal information. The Board submitted that since the head could have 
given access if a formal request had been made, the Board was then permitted to give access "in 
response to an oral request or in the absence of a request", as outlined in section 50(1) of the 
Act. 


The Board further submitted that since section 50(1) says "nothing in this Act prevents the head 
from giving access", then section 50(1) overrides all other sections of the Act, in particular 
section 32. It argued that even if the disclosure is not in accordance with section 32, access can 
be given pursuant to section 50(1) of the Act. The Board submitted that if the Legislature had 
intended to exclude section 32 when placing in section 50(1) the words "nothing in this Act", 
it would have done so. 


In addition, according to the Board, the reference to "information" in section 50(1) of the Act 
is a term broad enough to include both personal information and information that is not personal. 
In previous investigation reports, we have held the view that section 50(1) of the Act does not 
apply to personal information. The Board submitted that if the Legislature had intended personal 
information to be excluded from section 50(1), it would have said so. 
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We have carefully considered the Board’s previous submissions regarding this issue and its 
present submissions concerning the instant case. However, we do not agree with the Board’s 
interpretation of section 50(1) of the Act. 


The Board stated that the reference to "information" in section 50(1) of the Act is a term broad 
enough to include both personal information and information that is not personal. It is our view 
that section 50(1) of the Act was designed to promote routine disclosure of information, other 
than personal information, in accordance with the purposes of the Act. 


However, even assuming that section 50(1) applied to personal information, we do not agree 
with the Board’s argument. In our view, even if section 50(1) of the Act were to be interpreted 
as permitting the disclosure of personal information in the absence of a request under Part I, the 
disclosure under section 50(1) would still have to be in accordance with the Act since that 
section specifically states "If a head may give access to information under this Act..." 
(emphasis added). Therefore, the disclosure would need to comply with Part I of the Act and 
section 50(1) would not override all other sections of the Act. In order to comply with Part I, 
an institution would need to comply with the notification provisions set out in section 21 of the 
Act. This section requires the notification of individuals in situations where disclosure of the 
personal information might constitute an "unjustified invasion of personal privacy". It provides 
that an individual should be given an opportunity to explain why, in their view, the disclosure 
of the information might be an unjustified invasion of personal privacy, before the head makes 
a decision regarding whether to provide access to the personal information. In our view, 
adopting an interpretation of section 50(1) which avoids the need for the notification of affected 
parties would be inconsistent with the purposes of the Act. 


Therefore, since it is our view that the disclosure would not have complied with Part I of the 
Act, it would not have been in accordance with section 50(1) of the Act. 


In addition, it is our view that none of the disclosure provisions of section 32 of the Act applied 
to the disclosure of the personal information in question. Therefore, the disclosure of the 


complainant’s personal information was not in accordance with the Act. 


Conclusion: The Board’s disclosure of the complainant’s personal information to the 
newspaper was not in accordance with the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The Board’s disclosure of the complainant’s personal information to the newspaper was 


not in accordance with the Act. 
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We recommend that the Board take the necessary precautions to ensure that in future, all 
disclosures of personal information are made in accordance with the Act. For example, advice 
regarding the disclosure of the names of individuals making access requests under the Act should 
be incorporated into any Board policies or guidelines concerning the Act. 


Since we have already made this recommendation to the Board in a previous investigation, the 
Board may provide the Office of the Information and Privacy Commissioner with proof of 
compliance with this recommendation, at the same time it responds to the earlier investigation. 


Original signed by: September 29, 1993 
Ann Cavoukian, Ph.D. Date 
Assistant Commissioner @ 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ontario Labour 
Relations Board (the Board). 


The complaint was filed by an employer (the Employer) on behalf of its employees. 


The Employer was engaged in a dispute with a union (the Union) before the Board. The Union 
was seeking to unionize the Employer’s employees, and, to this end, had commenced 
certification proceedings before the Board. During the course of these proceedings, the 
Employer was required to submit four lists of its employees to the Board. Ina letter to the 
Board, the Union asked the Board for a copy of these lists. In a written decision, the Board 
complied with the Union’s request, ordering the labour relations officer involved in the case to 
disclose the lists to the Union. 


The Employer has submitted that the Board’s disclosure of the lists, which contained the 
employees’ personal information, was contrary to the Freedom of Information and Protection 


of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? 


(B) Was the disclosure of the personal information by the Board in accordance with 
section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 2(1) 
of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name if it appears with other personal information 


relating to the individual or where the disclosure of the name 
would reveal other personal information about the individual; 


{IPC Investigation 193-023P/October 28, 1993] 


ey 


The four lists contained each employee’s name, his/her occupational classification, and an 
indication of whether or not the employee worked 24 hours per week or more. The lists 
contained additional information including whether or not the employee was at work on the 
application date; the municipality in which each employee worked; an indication of whether the 
employee was not at work on the application date by reason of lay-off; the date of lay-off; the 
expected date of recall; an indication of whether the employee was in the bargaining unit on the 
application date; the last day the employee worked; the reason for the employee’s absence on 
the application date; and the expected date of return to work. 


In our view, the information in these lists met the requirements in Dopee oe (h) of the definition 
of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Was the disclosure of the personal information by the Board in accordance with 
section 42 of the Act? 


Under the Act, personal information in the custody or control of an institution can not be 
disclosed except in the specific circumstances outlined in sections 42(a) to 42(n). 


Both the Employer and the Board made submissions regarding the application of sections 42(a), 
42(c) and 42(e) of the Act to the disclosure of the lists. Therefore, we have examined each of 
these sections separately. 


Section 42 of the Act states, in part: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(a) in accordance with Part II; 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


(e) for the purpose of complying with an Act of the Legislature or an Act of 
Parliament or a treaty, agreement or arrangement thereunder; 


Section 42(a) 
Section 42(a) states that an institution shall not disclose personal information except in 
accordance with Part II of the Act. Section 21 of Part II of the Act provides a general rule of 


non-disclosure of personal information to any person other than the person to whom the 
information relates. Certain exceptions to this general rule are set out in section 21(1). These 
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exceptions include, in part, where it would not be an unjustified invasion of personal privacy 
to disclose the personal information. Sections 21(2) and 21(3) then provide a series of guidelines 
and/or presumptions that are to be taken into account by the head in determining whether or not 
a particular disclosure constitutes an unjustified invasion of personal privacy. The head is also 
obliged, under section 21(2) to "consider all the relevant circumstances", in addition to those 
expressly mentioned. 


The Board submitted that the disclosure of the personal information was: 


in accordance with Part II of the FIPPA [per section 42(a)] and did not constitute 
an "unjustified invasion of personal privacy" within the meaning of section 
21(1)(f), having regard to section 21(2)(d). 


The Board further stated that: 


It is submitted that no statutory presumption against disclosure is appropriate 
under section 21(3) of FIPPA. For the reasons expressed above, it is the Board’s 
position that the information in issue does not relate to "employment history" 
within paragraph (d). It is submitted that no other part of section 21(3) is even 
arguably relevant. 


It is further submitted that the information in issue is "relevant to a fair 
determination of nights" within section 21(2)(d), and that disclosure is not 
"unjustified" in these circumstances. 


The Board referred us to certain case law. It submitted that the practice of the Board is rooted 
in considerations of fairness and the protection and advancement of statutory rights. In 
summary, the Board stated that: 


In short, the OLRB [the Board] is obliged by the rules of natural justice to 
provide an applicant union with access to the information contained in the 
employee lists before the Board acts on that information in making any 
determination which affects or determines that union’s nghts. The information 
in the lists is not only relevant but critical to a fair determination of rights in 
certification cases. 


The Employer submitted that the disclosure was not in accordance with Part II of the Act and 
section 42(a) of the Act since it could be presumed to constitute an unjustified invasion of 
personal privacy. The Employer submitted that: 


With respect to Section 42(a) and Section 21, we note that there has been no 
written request or consent by the individual employees involved, so that Section 
21(1)(a) is inapplicable. With respect to Section 21(1)(d), there is no provision 
under the Labour Relations Act which "expressly authorizes the disclosure", so 
that that exception is also inapplicable. Nor can it be said that Section 21(1)(f) 
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applies. In this regard, we submit that Section 21(3)(d) prevails, so as to give 
rise to the statutory presumption contained therein that the disclosure of this 
personal information constitutes an unjustified invasion of privacy. None of the 
limitations contained in Section 21(4) apply. Section 21(4)(a) does not apply 
since we are not here dealing with "an individual who is or was an officer or 
employee of an institution...". 


We have carefully considered the submissions made by both parties. In previous compliance 
investigations, we have held the view that the section 42(a) exception to the section 42 
prohibition against disclosure of personal information only applies in the context of a request by 
an individual, under Part II of the Act, for personal information relating to another individual. 


In this case, the Union requested, in a letter which accompanied its application for certification, 
that the employee lists be forwarded by the Board to the Union immediately upon receipt by the 
Board. No mention was made that the Union’s request was pursuant to the Act. Since the 
circumstances of the disclosure did not involve an access request under Part II of the Act, it is 
our view that section 42(a) did not apply. 


However, even assuming that the request by the Union was an access request under Part II of 
the Act, the Board would have had to comply with the provisions of Part II, in order for the 
disclosure to have been in accordance with section 42(a) of the Act. 


Section 28(1)(b) of Part II of the Act states: 
28.-(1) Before a head grants a request for access to a record, 


(b) that is personal information that the head has reason to believe might 
constitute an unjustified invasion of personal privacy for the purposes of 
clause 21(1)(f), 


the head shall give written notice in accordance with subsection (2) to the person 
to whom the information relates. 


Under this section, before a head grants a request for access to a record, if the head has reason 
to believe that 21(1)(f) might apply i.e. the disclosure of the information might constitute an 
unjustified invasion of personal privacy, written notice must be given in accordance with section 
28(2) of the Act. 


In this case, it is our view that the head had had reason to believe that the disclosure of the 
employees’ personal information might constitute an unjustified invasion of personal privacy, 
if simply through its considerations of the submissions made by the Employer to the Board. 
Therefore, in order to comply with section 28, notice would have had to have been given to the 
employees. In our view, since no notice was given, the disclosure cannot be said to have been 
in accordance with section 28 of Part II of the Act and, therefore, cannot have been in 
accordance with section 42(a) of the Act. 
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Section 42(e) 
With respect to the application of section 42(e), the Board stated: 


The Board also relies on section 42(e) of FIPPA. ...As explained, the Board 
collects the information in question so that it may do that which is required of it 
under section 8 of the Labour Relations Act in respect of certification 
applications. It is submitted that the disclosure of the employee lists is necessary 
in order to comply with the requirement in section 104(13) of the Labour 
Relations Act that the Board give "full opportunity to the parties to any 
proceeding to present their evidence and to make their submissions." For such 
an “opportunity” to have substance, an interested party must be fully informed as 
to the case to be met. ... Indeed, it is submitted that a refusal to supply 
employee lists could not be rationally supported under section 104(13) of the 
Labour Relations Act. 


The Employer submitted the following: 


We further submit that Section 42(e) does not allow for the disclosure of this 
personal information, since the Labour Relations Act does not require the Ontario 
Labour Relations Board to disclose this information to the applicant union and 
therefore such disclosure is not necessary "for the purpose of complying with an 
Actas 


In our view, the Board is relying on an implicit, rather than an express, provision of the Labour 
Relations Act to authorize disclosure of the employee lists to the Union. There is, in fact, no 
express provision of the Labour Relations Act which requires the Board to disclose such 
information. In our view, it cannot be said that in supplying the employee lists to the Union, 
the Board was "complying with an Act of the Legislature” since there is no provision in the 
Ontario Labour Relations Act which required it to do so. Therefore, in our view, the disclosure 
was not in accordance with section 42(e) of the Act. 


Section 42(c) 


Section 42(c) of the Act states that an institution shall not disclose personal information except 
for the purpose for which it was obtained or compiled or for a consistent purpose. With respect 
to the application of section 42(c) of the Act, the Board submitted as follows: 


The Board also relies on section 42(c) of FIPPA. As explained above, the 
information contained in employee lists is collected to allow the Board to fulfil 
its statutory duty in the context of a "lis" between an applicant union and 
respondent employer. The Board is required, as a matter of law, to determine 
the number and identity of employees properly in the "appropriate bargaining 
unit" and the parties are entitled, as a matter of law, to disclosure of (and to 
make representations with respect to) relevant evidential material which affects 
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the disposition of an essential issue in this case. Accordingly, the information is 
collected precisely so that it may be disclosed, as a first step in the Board making 
the required determination under section 8 of the [Ontario Labour Relations Act]. 


The Employer submitted the following: 


Nor can it be said that Section 42(c) applies, since it cannot be said that the 
employee lists were compiled for the purpose of providing a copy thereof to the 
[Union]. Rather, the purpose of obtaining the employee lists was to allow the 
OLRB [the Board] to satisfy itself as to the number of employees in the 
bargaining unit or units in question so that it can in turn determine whether the 
Union enjoys the support of the requisite percentage of employees in each unit. 
It is submitted that this can be done without releasing this information to the 


[Union]. 


In our view, it seems clear that the Board obtained the employee lists for the purpose of 
reviewing an application for union certification pursuant to section 8 of the Ontario Labour 
Relations Act. If, in the course of conducting such a review, the Board decides it is appropriate 
for each of the parties to have access to the lists, then, in our view, the Board’s disclosure of 
the lists to the parties is for the purpose for which they were obtained, i.e. conducting a review 
of the application for union certification. 


Therefore, in our view, since the personal information was disclosed for the purpose for which 
it was obtained by the Board, the disclosure was in accordance with section 42(c) of the Act. 


Conclusion: The disclosure of the personal information by the Board was in accordance 
with section 42(c) of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The disclosure of the personal information by the Board was in accordance with section 


42(c) of the Act. 


Original signed by: October 28, 1993 
Susan Anthistle Date 


Compliance Review Officer 


[IPC Investigation 193-023P/October 28, 1993] 


(( 


( 


Commissioner/Ontario 


se 


80 Bloor Street West, 
Suite 1700, 

Toronto, Ontario 
M5S 2V1 


Information and Privacy 


Commissaire a l'information 
et ala protection de la vie privée/Ontario 


INVESTIGATION REPORT 


INVESTIGATION I93-031M 


80, rue Bloor ouest 
Bureau 1700 
Toronto (Ontario) 
M5S 2V1 


A TOWNSHIP 


416-326-3333 
1-800-387-0073 
Fax/Téléc: 416-325-9195 


Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontano, Sth Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toll free in 
Ontario 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvermemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de l'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1N8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d'interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésorier de l'Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named Township (the 
Township). 


An individual complained that the Township had disclosed his personal information contrary to 
the provisions of the Municipal Freedom of Information and Protection of Privacy Act, (the 
Act). The complainant stated that he had filed a complaint with the Ontario Provincial Police 
(the police) concerning certain members of the Township’s Council who had threatened him with 
violence at a council meeting. The police had then conducted an investigation but no charges 
were laid. According to the complainant, the Township had then obtained a copy of the police’s 
General Occurrence Report dated April 30, 1993 (the report) and was selling the report to the 
public at twenty five cents a copy. 

Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the personal information in accordance with section 32 of 
the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states in part: 


"personal information" means recorded information about an identifiable 
individual, including, 
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(h) the individual’s name if it appears with other personal 
information relating to the individual or where the disclosure of 
the name would reveal other personal information about the 
individual; (emphasis added) 


We have reviewed a copy of the report. The report contained the complainant’s name together 
with other personal information about him, including specific statements attributed to him. 


In its reply to our draft report, the Township submitted that the description of any actions or 
statements attributed to the complainant did not constitute "personal information" since "any and 
all actions described in the Incident Report arose out of a public Council meeting..." 


In our view, the fact that the actions described in the report took place in an open council 
meeting was not relevant to the determination that the statements attributed to the complainant 
constituted his personal information. We remain of the view that the information contained in 
the report satisfied the requirements of paragraph (h) of the definition of "personal information" 
in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in section 2(1) 
of the Act. 


Issue B: Was the disclosure of the "personal information" in accordance with section 
32 of the Act? 


Under the Act, an institution shall not disclose personal information in its custody or under its 
control except in the specific circumstances outlined in section 32. 


The Township stated that it had relied on section 32(e) of the Act for the disclosure of the 
report. Section 32(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or treaty; 


The Township had requested the report from the police. When the report was received by the 


Township, it was made the subject of a motion at a regular meeting of Council, on June 17, 
1993. It was the Township’s position that the report became a Township record once it was 
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received as correspondence. 


The Township stated that under section 73 of the Municipal Act, one of the Clerk’s duties is to 
keep records of the Council and that section 74(1) of the Municipal Act provides that: 


Any person may, at all reasonable hours, inspect any of the records, books or 
documents mentioned in section 73 and the minutes and proceedings of any 
committee of the council, whether the acts of the committee have been adopted 
or not, and other documents in possession or under the control of the clerk, and 
the clerk shall, within a reasonable time, furnish copies of them, certified under 
the clerk’s hand and the seal of the corporation of the municipality, to any 
applicant on payment at such rate as the council may by by-law establish. 


It is also the Township’s position that at no time did it sell copies of the report but rather, it 
charged the usual photocopying fee for records requested by members of the public. Therefore, 
according to the Township, it was permitted to disclose the report under section 74 of the 
Municipal Act and to provide a copy of it for a twenty five cents fee. 


We have ascertained that section 74(1) of the Municipal Act was amended in 1992 to read at the 
beginning "Subject to the Municipal Freedom of Information and Protection of Privacy Act." 
Therefore, the Township was required to determine if any provisions of section 32 applied 
before disclosing records containing personal information under section 74(1) of the Municipal 
Act. We have determined that the Township did not do so in this case. It is our view that the 
Township’s disclosure of the report was, therefore, not in accordance with section 74(1) of the 
Municipal Act and was, thus, not in accordance with section 32(e) of the Act. 


In its submissions to our draft report, the Township stated that section 32(c) of the Act also 
applied to the disclosure of the complainant’s personal information. This section states that: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


The Township stated that it had obtained the report in order to determine the status of the police 
investigation and to complete the Township’s records with respect to this matter. In our view, 
the Township’s subsequent disclosure of the complainant’s personal information contained in the 
report to the public was not for the purpose for which the personal information had been 
obtained or compiled. 
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Under Section 32(c), personal information can also be disclosed for a "consistent purpose". 
Section 33 of the Act further provides that: 


The purpose of a use or a disclosure of personal information that has been 
collected directly from the individual to whom the information relates is a 
consistent purpose under clauses 31(b) and 32(c) only if the individual might 
reasonably have expected such a use or disclosure. 


However, in this case where the personal information had been collected indirectly from the 
complainant, a consistent purpose would be one that was "reasonably compatible" with the 
purpose for which the personal information had been obtained. In our view, the Township’s 
disclosure of the complainant’s personal information to the public cannot be said to have been 
for a purpose that was reasonably compatible with the purpose for which the personal 
information had been collected. In our view, the Township’s disclosure was not for a consistent 
purpose and was, therefore, not in accordance with section 32(c) of the Act. 


We have examined the other provisions of section 32 and have determined that none applied to 
the Township’s disclosure of the report containing the complainant’s personal information. 


Conclusion: The Township’s disclosure of the complainant’s personal information was not in 
accordance with section 32 of the Act. 


OTHER MATTERS 


In its submissions on our draft report, the Township also stated that it was its view that section 
27 of the Act was applicable. This section states that: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


In our view, the police created the report containing the complainant’s personal information as 
part of its investigative process. The Township then obtained the report in order to ascertain 
the status of the investigation and to complete its records. It is our view that it cannot be said 
that the Township had obtained and was maintaining the complainant’s personal information 
specifically for the purpose of creating a record to be made available to the public. In our view, 
Section 27 did not apply to the complainant’s personal information. 


The Township also submitted that the disclosure of the report was in accordance with sections 


14(1)(c), 14(2)(a) and 16 of the Act. These sections of the Act apply to the release of personal 
information in response to a freedom of information access request made under Part I of the Act. 


[IPC Investigation [93-031M/December 31, 1993] 


rt Shes 


In this case, the disclosure of the complainant’s personal information was not in the context of 
an access request under the Act to the Township for the complainant’s personal information. 
In our view, therefore, sections 14(1)(c), 14(2)(a) and 16 of the Act did not apply. 


Conclusion: Sections 14(1)(c), 14(2)(a), 16 and 27 of the Act did not apply. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The Township’s disclosure of the complainant’s personal information was not in 


accordance with section 32 of the Act. 


e Sections 14(1)(c), 14(2)(a), 16 and 27 of the Act did not apply. 


RECOMMENDATION 


The Township should establish written procedures to ensure that records which contain personal 
information are disclosed only in accordance with the Act. 


Within six months of receiving the report, the Township should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: December 31, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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Suite 1700, Bureau 1700 1-800-387-0073 
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Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontario, Sth Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toll free in 
Ontario 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de l'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1N8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d’interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésoner de |'Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named Township (the 
Township). 


An individual complained that the Township had disclosed his personal information contrary to 
the provisions of the Municipal Freedom of Information and Protection of Privacy Act, (the 
Act). The complainant stated that he had filed a complaint with the Ontario Provincial Police 
(the police) concerning certain members of the Township’s Council who had threatened him with 
violence at a council meeting. The police had then conducted an investigation but no charges 
were laid. According to the complainant, the Township had then obtained a copy of the police’s 
General Occurrence Report dated April 30, 1993 (the report) and was selling the report to the 
public at twenty five cents a copy. 

Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the personal information in accordance with section 32 of 
the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


secee 
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(h) the individual’s name if it appears with other personal 
information relating to the individual or where the disclosure of 
the name would reveal other personal information about the 
individual; (emphasis added) 


We have reviewed a copy of the report. The report contained the complainant’s name together 
with other personal information about him, including specific statements attributed to him. 


In its reply to our draft report, the Township submitted that the description of any actions or 
statements attributed to the complainant did not constitute "personal information" since "any and 
all actions described in the Incident Report arose out of a public Council meeting..." 


In our view, the fact that the actions described in the report took place in an open council 
meeting was not relevant to the determination that the statements attributed to the complainant 
constituted his personal information. We remain of the view that the information contained in 
the report satisfied the requirements of paragraph (h) of the definition of "personal information" 
in section 2(1) of the Act. 


Conclusion: The information in question was “personal information" as defined in section 2(1) 
of the Act. 


Issue B: Was the disclosure of the "personal information" in accordance with section 
32 of the Act? 


Under the Act, an institution shall not disclose personal information in its custody or under its 
control except in the specific circumstances outlined in section 32. 


The Township stated that it had relied on section 32(e) of the Act for the disclosure of the 
report. Section 32(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or treaty; 


The Township had requested the report from the police. When the report was received by the 


Township, it was made the subject of a motion at a regular meeting of Council, on June 17, 
1993. It was the Township’s position that the report became a Township record once it was 
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received as correspondence. 


The Township stated that under section 73 of the Municipal Act, one of the Clerk’s duties is to 
keep records of the Council and that section 74(1) of the Municipal Act provides that: 


Any person may, at all reasonable hours, inspect any of the records, books or 
documents mentioned in section 73 and the minutes and proceedings of any 
committee of the council, whether the acts of the committee have been adopted 
or not, and other documents in possession or under the control of the clerk, and 
the clerk shall, within a reasonable time, furnish copies of them, certified under 
the clerk’s hand and the seal of the corporation of the municipality, to any 
applicant on payment at such rate as the council may by by-law establish. 


It is also the Township’s position that at no time did it sell copies of the report but rather, it 
charged the usual photocopying fee for records requested by members of the public. Therefore, 
according to the Township, it was permitted to disclose the report under section 74 of the 
Municipal Act and to provide a copy of it for a twenty five cents fee. 


We have ascertained that section 74(1) of the Municipal Act was amended in 1992 to read at the 
beginning "Subject to the Municipal Freedom of Information and Protection of Privacy Act." 
Therefore, the Township was required to determine if any provisions of section 32 applied 
before disclosing records containing personal information under section 74(1) of the Municipal 
Act. We have determined that the Township did not do so in this case. It is our view that the 
Township’s disclosure of the report was, therefore, not in accordance with section 74(1) of the 
Municipal Act and was, thus, not in accordance with section 32(e) of the Act. 


In its submissions to our draft report, the Township stated that section 32(c) of the Act also 
applied to the disclosure of the complainant’s personal information. This section states that: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


The Township stated that it had obtained the report in order to determine the status of the police 
investigation and to complete the Township’s records with respect to this matter. In our view, 
the Township’s subsequent disclosure of the complainant’s personal information contained in the 
report to the public was not for the purpose for which the personal information had been 
obtained or compiled. 
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Under Section 32(c), personal information can also be disclosed for a "consistent purpose”. 
Section 33 of the Act further provides that: 


The purpose of a use or a disclosure of personal information that has been 
collected directly from the individual to whom the information relates is a 
consistent purpose under clauses 31(b) and 32(c) only if the individual might 
reasonably have expected such a use or disclosure. 


However, in this case where the personal information had been collected indirectly from the 
complainant, a consistent purpose would be one that was "reasonably compatible" with the 
purpose for which the personal information had been obtained. In our view, the Township’s 
disclosure of the complainant’s personal information to the public cannot be said to have been 
for a purpose that was reasonably compatible with the purpose for which the personal 
information had been collected. In our view, the Township’s disclosure was not for a consistent 
purpose and was, therefore, not in accordance with section 32(c) of the Act. 


We have examined the other provisions of section 32 and have determined that none applied to 
the Township’s disclosure of the report containing the complainant’s personal information. 


Conclusion: The Township’s disclosure of the complainant’s personal information was not in 
accordance with section 32 of the Act. 


OTHER MATTERS 


In its submissions on our draft report, the Township also stated that it was its view that section 
27 of the Act was applicable. This section states that: 


This Part does not. apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


In our view, the police created the report containing the complainant’s personal information as 
part of its investigative process. The Township then obtained the report in order to ascertain 
the status of the investigation and to complete its records. It is our view that it cannot be said 
that the Township had obtained and was maintaining the complainant’s personal information 
specifically for the purpose of creating a record to be made available to the public. In our view, 
Section 27 did not apply to the complainant’s personal information. 


The Township also submitted that the disclosure of the report was in accordance with sections 


14(1)(c), 14(2)(a) and 16 of the Act. These sections of the Act apply to the release of personal 
information in response to a freedom of information access request made under Part I of the Act. 
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In this case, the disclosure of the complainant’s personal information was not in the context of 
an access request under the Act to the Township for the complainant’s personal information. 
In our view, therefore, sections 14(1)(c), 14(2)(a) and 16 of the Act did not apply. 


Conclusion: Sections 14(1)(c), 14(2)(a), 16 and 27 of the Act did not apply. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The Township’s disclosure of the complainant’s personal information was not in 


accordance with section 32 of the Act. 


e Sections 14(1)(c), 14(2)(a), 16 and 27 of the Act did not apply. 


RECOMMENDATION 


The Township should establish written procedures to ensure that records which contain personal 
information are disclosed only in accordance with the Act. 


Within six months of receiving the report, the Township should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: December 31, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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Suite 1700, Bureau 1700 4-800-387-0073 
Toronto, Ontario Toronto (Ontario) 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a City. The complainant, 
an employee of the City, made a claim to the Worker’s Compensation Board (WCB) with 
respect to a back injury. His claim was denied, and later, when he made a request to WCB for 
access to his claim file, he found that the City had disclosed information about him to WCB. 
His view was that some of the information disclosed was not relevant to his claim, and that the 
disclosure of this information to WCB breached the Municipal Freedom of Information and 
Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Did the records in question contain the complainant’s "personal information", as 
defined in section 2(1) of the Act? If yes, 


(B) Were the records in question disclosed in accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Did the records in question contain the complainant’s "personal information", 
as defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
- age, sex, sexual orientation or marital or family status of the individual, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, 


(c) any identifying number, symbol or other particular assigned to the 
individual, 
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(g) the views or opinions of another individual about the individual, and 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The records in question were the complainant’s Short Term Disability (STD) Report, Sick Leave 
Record, Employee History Record, two letters written by employees of the City to WCB, and 
the WCB Investigator’s report. 


It is our view that the above records contained information about the complainant which met the 


requirements in paragraphs (a), (b), (c), (g), and (h) of the definition of personal information 
in section 2(1) of the Act. 


Conclusion: The records in question contained information which was personal 
information, as defined in section 2(1) of the Act. 
Issue B: Were the records in question disclosed in accordance with section 32 of the 


Act? 


The City stated that the complainant had signed a consent (i.e. a Medical Records Waiver) in 
accordance with section 31(a) of the Act for the release of information in his medical records. 


Section 31(a) of the Act states: 


An institution shall not use [emphasis added] personal information in its custody 
or under its control except, 


(a) if the person to whom the information relates has identified that 
information in particular and consented to its use; 


The issue in this case is the disclosure, rather than use of the complainant’s personal 
information. Therefore, the relevant section of the Act is section 32. Section 32 of the Act 
prohibits the disclosure of personal information by an institution except in the circumstances 
listed in section 32(a) through (1). Section 32 states in part: 


An institution shall not disclose personal information in its custody or under its 
control except, 
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(b) if the person to whom the information relates has identified that 
information in particular and consented to its disclosure; 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


(e) for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or treaty; 


The Medical Records Waiver provided to the City by WCB stated: 


This will be your authority to allow a representative of the Worker’s 
Compensation Board of Ontario to have access to my medical [emphasis added] 
records and to receive copies thereof at [the City’s] First Aid Dept. 


In our view, the section of the Act pertaining to the above consent form is section 32(b). The 
form indicates that the complainant specifically identified his medical records and authorized 
them to be disclosed to WCB by the City. Since the above consent form clearly applies to the 
disclosure of medical records only, it is our view that the City could not rely on the above 
consent form to authorize the disclosure of non-medical information about the complainant. We 
examined the remaining disclosure provisions of section 32 and determined that section 32(c) 
and 32(e) applied in the circumstances of this case. 


In our view, if the disclosures in question were made in accordance with sections 32(c) or (e) 
of the Act, it would not have been necessary for the City to obtain the complainant’s consent 
for disclosure. Therefore, we considered sections 32(b),(c), and (e) in determining whether the 
Act had been breached by the City’s disclosures to WCB. | 


Short Term Disability Report 


The City stated that it was its view that the STD Report formed part of the complainant’s 
medical record maintained by the City, and that the complainant had consented to the disclosure 
of this information, in accordance with section 31(a) [32(b)] of the Act when he signed the 
Medical Records Waiver. 


We agree with the City’s view that the complainant’s STD report, which contained his name, 
employee number, dates and term of his STD claim, and the amount of STD benefits paid to 


him formed part of the complainant’s medical record with the City. Therefore, it is our view 
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that complainant’s personal information in the STD report was disclosed in accordance with 
section 32(b) of the Act. 


Conclusion: The complainant’s personal information in the STD report was disclosed 
in accordance with section 32 of the Act. 


Sick Leave Record 
The City stated that: 


.... the disclosure of a sick leave record to the WCB for the consideration when 
investigating a claim for disablement that developed over the course of 
employment and not as the result of a specific accident is in accordance with 
subsection 32(c) as the use of the record is for a purpose consistent with the use 
for which the record was compiled. 


It is our view that sections 32(b) and (c) applied to the disclosure of the complainant’s personal 
information in the Sick Leave Record. The Sick Leave Record contained the complainant’s 
name, employee number, and the number of hours he had taken for sick leave with/without pay, 
short term disability, surplus time in lieu of sick time, and compensation (WCB). It is our view 
that the above items formed part of the complainant’s medical record with the City, and as such, 
were disclosed in accordance with section 32(b) of the Act. The remaining item at issue is the 
record of leaves of absence without pay. 


The complainant’s view was that the record of his leaves of absence was not relevant to his 
WCB claim. We asked the City why information about leaves of absence without pay would 
have been disclosed to WCB, since these leaves would not necessarily be taken for illnesses or 
injuries, or form part of an employee’s medical records. The City stated that leaves of absence 
could be taken for a variety of reasons, including illness and injury and could be significant 
information when considering a, claim for any disablement arising out of the nature of 
employment. However, the City gave no evidence to show that the leaves of absence in question 
had been used for illness or injuries. 


Section 32(c) states that personal information may be disclosed for the purpose for which it was 
obtained or compiled or for a consistent purpose. In our view, the information in the Sick Leave 
Record would have been compiled by the City for the purpose of creating a record of absences 
to use in the administration of its human resources programs. The purpose for disclosing 
information about absences to WCB would have been to provide the Investigator with an overall 
picture of the complainant’s absenteeism from work. 


In our view, the complainant’s personal information relating to his leaves of absence in the Sick 
Leave Record was not disclosed for the purpose for which it had been compiled by the City. 
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Therefore, we considered whether the City’s disclosure was for a consistent purpose. Section 
33 of the Act states: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. 


Since the information in the Sick Leave Record was not collected directly from the complainant, 
the complainant’s reasonable expectations could not be a factor in determining whether the 
disclosure had been made for a consistent purpose. In our view, whether the disclosure was 
made for a consistent purpose should be determined by considering whether the purpose for the 
disclosure was reasonably compatible with the purpose for which the information had been 
obtained or compiled by the City. 


In our view, disclosing the complainant’s absence information for the purpose of providing the 
WCB Investigator with an overall picture of the complainant’s absenteeism with the City is 
reasonably compatible with the purpose for which the City compiled the information - to create 
a record of the complainant’s absenteeism for use in administering its human resources 
programs. Therefore, it is our view that in the circumstances of this case, the disclosure of the 
record of leaves of absence was made in accordance with section 32(c) of the Act, for a 
consistent purpose. 


Conclusions: The complainant’s personal information that formed part of his medical 
records in the Sick Leave Record was disclosed in accordance with section 
32 of the Act. 


The complainant’s personal information in his leave of absence record was 
disclosed in accordance with section 32 of the Act. 


Employee History Record 
The City stated that the Employee History Record was disclosed in accordance with section 32(e) 
of the Act (i.e. in order to comply with an Act of the Legislature) upon request from the WCB 
Investigator. The City referred to section 133(1) of the Workers’ Compensation Act (WCA), 
which states: 

Every employer, within three days after learning of the happening of an accident 

to a worker in the employer’s employment by which the worker is disabled shall 

notify the Board in writing of, 

(a) the happening of the accident and the nature of it; 
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(b) the time of its occurrence; 

(c) the name and address of the worker 

(d) the place where the accident happened 

(e) the name and address of the physician or surgeon, if any, by whom the 
worker was or is attended for the injury, 


and shall in any case furnish such further details and particulars respecting any 
accident or claim to compensation as the Board may require. 


As we understand the situation, the complainant’s WCB claim was not made as the result of a 
specific accident, but rather was for an injury which developed over the course of employment. 
In our view, WCB would have had to require details or particulars respecting the complainant’s 
claim to compensation, in order for section 133 of the WCA to apply in the circumstances of 
this case. 


In our view, some items of the complainant’s personal information in the Employee History 
record were details or particulars respecting the complainant’s claim (e.g. name, position, 
birthdate, seniority date, retirement date). Since WCB had required that the City furnish 
information respecting the claim, we conclude that the disclosure of this personal information 
was made in accordance with section 32(e) of the Act, for the purpose of complying with an Act 
of the Legislature. ; 


However, in our view, some items of the complainant’s personal information in his Employee 
History Record were not details or particulars respecting the claim (e.g. records of suspensions 
from driving for speeding). Since the WCA states that the employer is to "furnish such further 
details and particulars respecting any ....claim to compensation", it is our view that section 133 
of the WCA would not apply in the circumstances of the disclosure of details or particulars 
which, in our view, did not pertain to the complainant’s claim . Therefore, we conclude that 
the disclosure of this personal information was not made in accordance with section 32(e) of the 
Act, for the purpose of complying with an Act of the Legislature. It is our view that no other 
sections of the Act applied to the disclosure of this information. 


Conclusions: The items of the complainant’s personal information in the Employee 
History Record that were details respecting the claim were disclosed in 
accordance with section 32 of the Act. 


The items of complainant’s personal information in the Employee History 


Record that were not details respecting the claim were not disclosed in 
accordance with section 32 of the Act. 
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Letter to WCB from General Superintendent of Operations 


The City stated that the information contained in the letter was requested by WCB and was 
disclosed pursuant to section 32(e) of the Act. 


The letter contained the complainant’s name, employee number, date of employment with the 
City, amount of accumulated sick time by a certain date, and the rate at which sick time would 
have been earned. In our view, these were details respecting the claim. Since the above items 
of information were details or particulars respecting the claim, and WCB had required that the 
City furnish the information, we conclude that the disclosure was made in accordance with 
section 32(e) of the Act, for the purpose of complying with an Act of the Legislature. 


Conclusion: The complainant’s personal information in the letter to WCB from the 
General Superintendent of Operations was disclosed in accordance with 
section 32 of the Act. 


Letter to WCB from Co-ordinator, Rehabilitation and Claims Administration 


The letter to WCB from the Co-ordinator, Rehabilitation and Claims Administration, contained 
the complainant’s name, social insurance number, details of his current and previous claims, 
details of his STD claim, his current position, the fact that he had been assigned to light duties, 
and his physical restrictions. This letter, which accompanied the WCB claim form, stated, 
"Obviously, this claim warrants your investigation". 


The claim form contained the question, "Do you have any reason to doubt the history of 
injury?", to which the City had answered "Yes". "See attached letter" was typed at the bottom 
of this section of the form. 


It is our view that the City’s purpose for compiling the complainant’s personal information in _ 
the above letter was to provide WCB with further information concerning its reasons for 
doubting the history of the claim, and to request an investigation. 


It is our view that the complainant’s personal information in the letter was disclosed for the 
purpose for which it had been compiled by the City - to provide further information concerning 
its reasons for doubting the history of the claim, and to request an investigation. Therefore, it 
is our view that the complainant’s personal information was disclosed in accordance with section 
32(c) of the Act, for the purpose for which it was compiled. 


Conclusion: The complainant’s personal information in the letter to WCB from the Co- 
ordinator, Rehabilitation and Claims Administration was disclosed in 


accordance with section 32 of the Act. 
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WCB Investigator’s Report 


As previously stated, our view is that the WCB Investigator’s report contained the complainant’ s 
personal information, including City employees’ opinions regarding the complainant. This 
information was apparently recorded by the WCB Investigator as a result of her interview with 
City employees. The complainant believed that the comments made were prejudicial to his 
claim. The comments attributed to the City employees were as follows: 


Comment #1: 


[employee] advised me that [complainant] is a complainer and complains about 
everything. 


Comment #2: 


[employee] elaborated indicating that [complainant] was a bit of a hypochondriac. He 
always seemed to have something wrong with him... 


Comment #3: 


[employee] indicated that the injured worker was a good worker when he originally 
commenced working for [the City]... 


The City stated that "the comments noted were verbal comments and opinions that did not form 
part of any record as defined in the act". We agree with the City that the comments made were 
verbal. It is our view that comments #1 and #2 did not contain information that would have 
been a matter of record with the City, and that the Act did not apply to these disclosures. 


However, Comment #3 contained information about the complainant’s job performance that had 
been recorded by the City on the Employee History Record approximately six months after he 
was hired (i.e." LAYOFF-EXCELLENT EMPLOYEE-WOULD REHIRE"). In her report, the 
WCB Investigator referred to the fact that the information had been recorded, stating: 


[employee] indicated that the injured worker was a good worker when he 
originally commenced working for [the City] as noted in the Employee History 
Record which was supplied to me by the employer. [emphasis added] 


Therefore, it is our view that the Act applied to this disclosure. The City stated that the 
comments made to the WCB Investigator were in response to questions asked by her during the 
interviews. Accordingly, it is our view that section 32(e) of the Act applied to the disclosure. 
It is our view that the complainant’s personal information in Comment #3 was details or 
particulars respecting his claim. Since WCB had required that the City furnish the information, 
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by asking questions during an interview, we conclude that the disclosure of this personal 


information was made in accordance with section 32(e) of the Act, for the purpose of complying 
with an Act of the Legislature. 


Therefore, it is our view that the disclosure of the complainant’s personal information in 
Comment #3 was made in accordance with section 32 of the Act. 


Conclusions: The Act did not apply to Employee Comments #1 and #2 in the WCB 
Investigator’s report. 


The complainant’s personal information in Employee Comment #3 in the 
WCB Investigator’s report was disclosed in accordance with section 32 of 
the Act. 


Other Matters 


During the course of this investigation, the following matter was identified and brought to the 
City’s attention: 


The complainant’s Employee History Record contained a reference to another employee. The 


City acknowledged that third party information that should have been severed was disclosed to 
WCB inadvertently. 


SUMMARY OF CONCLUSIONS 


e The records in question contained information which was personal information, as 
defined in section 2(1) of the Act. 


e The complainant’s personal information in the STD report was disclosed in accordance 
with section 32 of the Act. 


° The complainant’s personal information that formed part of his medical records in the 
Sick Leave Record was disclosed in accordance with section 32 of the Act. 


° The complainant’s personal information in his leave of absence record was disclosed in 
accordance with section 32 of the Act. 


° The items of the complainant’s personal information in the Employee History Record that 
were details respecting the claim were disclosed in accordance with section 32 of the Act. 


e The items of the complainant’s personal information in the Employee History Record that 
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were not details respecting the claim were not disclosed in accordance with section 32 
of the Act. 


° The complainant’s personal information in the letter to WCB from the General 
Superintendent of Operations was disclosed in accordance with section 32 of the Act. 


° The complainant’s personal information in the letter to WCB from the Co-ordinator, 
Rehabilitation and Claims Administration was disclosed in accordance with section 32 of 
the Act. 


° The Act did not apply to Employee Comments #1 and #2 in the WCB Investigator’s 
Teport. 


° The complainant’s personal information in Employee Comment #3 in the WCB 
Investigator’s report was disclosed in accordance with section 32 of the Act. 


RECOMMENDATIONS 


We recommend that the City incorporate the following into its procedures: 


that personal information not respecting an accident or claim be severed from 
records that are provided to WCB. 


Within six months of receiving this report, the City should provide the Office of the Information 
and Privacy Commissioner with proof of compliance with the above recommendation. 


Susan Anthistle Date 
Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Workers’ Compensation 
Board (the Board). 


The complainant stated that the Board had collected and disclosed information concerning her 
sexual life to her employer, and to her former claim representative, in contravention of the 
Freedom of Information and Protection of Privacy Act (the Act). 


The information was contained in a psychiatrist's Non Economic Loss Assessment and cover 
letter to the Board (the NEL), relating to the complainant’s claim for Chronic Pain Disability. 


The NEL contained information concerning the complainant’s medical condition and her sexual 
life with her spouse. 


The Workers’ Compensation Act has established a two-track benefit system for workers who 

suffer permanent consequences because of their workplace injuries. It provides compensation 

for the permanent impairment (the non-economic loss award for the loss of enjoyment of 
“3 everyday life) and the future loss of earnings (the economic loss award for the employment 

impact) which result from the injury. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information contained in the NEL "personal information" as defined in 
section 2(1) of the Act? If yes, 


(B) Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


(C) Was the personal information disclosed in accordance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 
Issue A: Was the information contained in the NEL "personal information" as defined 
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in section 2(1) of the Act? 
Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 
(h) the individual’s name where it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other personal 


information about the individual; 


We reviewed a copy of the NEL. It contained the compiainant’s name together with information 
about the complainant’s medical condition and her sexual life with her spouse. 


It is our view that the information contained in the NEL met the requirements of paragraph (h) 
of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information contained in the NEL was personal information as 
defined in section 2(1) of the Act. 


Issue B: Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Board stated that to properly make a NEL assessment, and to fairly determine the amount 
of compensation due to the complainant, collection of the information concerning her sexual life 


was necessary to the proper administration of a lawfully authorized activity. 


The Board referred us to section 42 of the Workers’ Compensation Act (the WCA), which 
addresses NEL assessments. Sections 42(1) and (5), in particular, state: 


(1) A worker who suffers permanent impairment as a result of an injury is 
entitled to receive compensation for non-economic loss in addition to any other 


benefit receivable under this Act. 


(5) The Board shall determine in accordance with the prescribed rating 
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schedule and having regard to medical assessments conducted under this section 
the degree of a worker’s permanent impairment expressed as a percentage of total 
permanent impairment. 


Based on the above provisions of the WCA, it is our view that conducting a NEL medical 
assessment to determine the compensation due to a worker who has suffered permanent 
impairment as a result of an injury, is a lawfully authorized activity. 


With regard to whether the collection of information concerning a worker’s sexual life is 
"necessary" to conducting NEL assessments, the Board advised us of the following. 


The Board stated that when considering the amount of compensation for a NEL award, it is 
important that a psychiatrist fully assess four areas of functioning, in determining the severity 
of impairment for the purposes of determining an award in cases of Chronic Pain Disability. 


The Board has adopted the American Medical Association (AMA) Guides to the Evaluation of 
Permanent Impairment. These areas are: 


1) Activities of Daily Living 

2) Social Functioning 

3) Concentration, persistence and pace 

4) Ability to adapt to stress circumstances. 


The Board explained that the more comprehensive the examination of these areas, the more 
accurate the evaluation of the extent of the impairment. Under Activities of Daily Living, the 
AMA Guides specify this to include activities such as "self care and personal hygiene, 
communication, ambulation, attaining all normal living posture, travel, non specialized hand 
activities, sexual function, social and recreational activities". The Guides also state that "what 
is assessed is not simply the number of activities that are restricted but the overall degree of 
restrictions or combination of restrictions". It is in this context that questions are asked by the 
physician about a worker’s sexual life. It is an aspect of functioning that can be impaired by 
a worker’s injury. If it is impaired, then the worker’s award should reflect that impairment in 
the context of his/her functioning in this and all the other areas examined. 


The Board stressed that it is important to understand that this is an extensive evaluation of the 
impact of the worker’s pain on his or her everyday life, and not just his/her work. This allows 
for compensation for changes from pre-accident levels of functioning. While sexual function 
may be a more sensitive area that is being assessed, it is no less important than the many other 
activities being examined to arrive at an award. In short, questions of a sexual nature are 
necessary to conduct a thorough assessment. 


Based on the above, it is our view that the Board had the authority to collect the information 
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concerning the complainant’s sexual life, as it was necessary to the proper administration of a 
lawfully authorized activity, that being, the conduct of a NEL medical assessment to determine 
appropriate compensation. Thus, the Board collected the complainant’s personal information in 
accordance with section 38(2) of the Act. 


Conclusion: The Board had the authority to collect the personal information, in 
accordance with section 38(2) of the Act. 
Issue C: Was the personal information disclosed in accordance with section 42 of the 


Act? 


The complaint concerns disclosure to a) the complainant’s employer, and b) the complainant’s 
former representative in her claim with the Board. 


Disclosure to the Employer 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 42. 


Section 42(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act 
of Parliament or a treaty, agreement or arrangement thereunder; 
(emphasis added) 


The Board cited section 42(12) of the WCA as its legislative authority for disclosure to the 
employer, in accordance with section 42(e) of the Act. 


Section 42(12) of the WCA requires the Board to send a copy of the NEL to the accident 
employer. It states: 


(12) The Board shall send a copy of the medical assessment conducted under 
subsection (9) to the worker and to the employer who employed the worker on 
the date of the injury. 


In our view, the Board’s disclosure of the complainant’s personal information to the employer 


was in accordance with section 42(e) of the Act, for the purpose of complying with an Act of 
the Legislature. 
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Disclosure to the Complainant’s Former Representative 


Injured workers may elect to have a representative of their choosing represent them in claims 
with the Board. Despite a letter on the Board’s file from the complainant dated June 11, 1992, 
advising that she had replaced her representative, the Board acknowledged that it had faxed a 
copy of the NEL to the complainant’s former representative. 


However, in support of this disclosure, the Board stated that the complainant had changed her 
representative on several occasions, and that the former representative had telephoned the NEL 
Manager, requesting a copy of the NEL. 


We were advised by the Board that it is the responsibility of the Adjudicator to make updates 
such as a change of representative on the "PARS" computer system. A clerk accesses "PARS" 
to obtain the address of the representative. In this case, it appears that the computer was not 
updated in a timely fashion. As a result, a disclosure to the complainant’s former representative 


was made in error. 


We examined section 42(b) of the Act with respect to this disclosure. This section states: 


An institution shall not disclose personal information in its custody or under its 
control except 


(b) where the person to whom the information relates has identified 
that information in particular and consented to its disclosure; 


However, we are of the view that the complainant did not identify the personal information and 
consent to its disclosure to her former representative. In our view, the Board’s disclosure of the 
complainant’s personal information to her former representative was not in accordance with 
section 42(b), or with any other provisions of section 42 of the Act. 


Conclusion: The Board’s disclosure of the NEL to the employer was in accordance 
with section 42 of the Act. 


The Board’s disclosure of the NEL to the complainant’s former 
representative was not in accordance with section 42 of the Act. 


Other Matters 


During the course of this investigation, the following matters were identified which should be 
brought to the Board’s attention. 
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Mailing Procedures for NELs 


We asked the Board about the manner in which NELs are sent to employers. We were advised 
that employers’ mailing addresses are identified on the computer system. If the employer has 
designated a named individual for its correspondence on a claim, the Adjudicator will update the 
system to state attention to this individual and the NEL would be sent, addressed accordingly. 
Accompanying the NEL is a cover letter reminding the employer of its obligation under the 
WCA to not disclose the information. Confidential envelopes are not used. 


We are concerned that the Board does not use confidential envelopes when mailing NELs to 
employers, and that where an appropriate official has not been identified, sensitive medical 
information may be viewed unnecessarily by the employer’s staff, eg. individuals responsible 
for opening and delivering the employer’s mail. 


Faxing of the NEL 


While this complaint did not concern the improper disclosure of personal information through 
the faxing of the NEL, we nonetheless wish to simply remind the Board of our faxing 
guidelines, since it is evident from the circumstances of this complaint that the Board has used 
a facsimile machine to transmit sensitive personal information. Accordingly, we have enclosed 
a copy of the following documents: "Guidelines on Facsimile Transmission Security, June 
1989" and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990". 


SUMMARY OF CONCLUSIONS 


e The information contained in the NEL was personal information as defined in section 
2(1) of the Act. 


e The Board had the authority to collect the personal information, in accordance with 
section 38(2) of the Act. 


e The Board’s disclosure of the NEL to the employer was in accordance with section 42 
of the Act. 
e The Board’s disclosure of the NEL to the complainant’s former representative was not 


in accordance with section 42 of the Act. 
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RECOMMENDATIONS 


1. We recommend that the Board take steps to ensure that adjudicators update the 
information in their computers as soon as they are notified of a change of representative; 
for example, by sending a memorandum to appropriate staff, i.e. adjudicators and their 
supervisors to remind them of this procedure. 


oe We recommend that the Board use confidential envelopes when mailing out medical 
information to employers. The envelopes should be addressed to a named officer, where 
this individual has been identified by the employer. If an officer has not been 
designated, a generic title should be used, for example, "WCB Claims Administrator". 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: November 26, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Workers’ Compensation 
Board (the Board). 


The complainant stated that the Board had collected and disclosed information concerning her 
sexual life to her employer, and to her former claim representative, in contravention of the 
Freedom of Information and Protection of Privacy Act (the Act). 


The information was contained in a psychiatrist’s Non Economic Loss Assessment and cover 
letter to the Board (the NEL), relating to the complainant’s claim for Chronic Pain Disability. 
The NEL contained information concerning the complainant’s medical condition and her sexual 
life with her spouse. 


The Workers’ Compensation Act has established a two-track benefit system for workers who 

suffer permanent consequences because of their workplace injuries. It provides compensation 

for the permanent impairment (the non-economic loss award for the loss of enjoyment of 
vi everyday life) and the future loss of earnings (the economic loss award for the employment 

impact) which result from the injury. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information contained in the NEL "personal information" as defined in 
section 2(1) of the Act? If yes, 


(B) Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


(C) Was the personal information disclosed in accordance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information contained in the NEL "personal information" as defined 
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in section 2(1) of the Act? 
Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 
(h) the individual’s name where it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other personal 


information about the individual; 


We reviewed a copy of the NEL. It contained the complainant’s name together with information 
about the complainant’s medical condition and her sexual life with her spouse. 


It is our view that the information contained in the NEL met the requirements of paragraph (h) 
of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information contained in the NEL was personal information as 
defined in section 2(1) of the Act. 


Issue B: Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Board stated that to properly make a NEL assessment, and to fairly determine the amount 
of compensation due to the complainant, collection of the information concerning her sexual life 


was necessary to the proper administration of a lawfully authorized activity. 


The Board referred us to section 42 of the Workers’ Compensation Act (the WCA), which 
addresses NEL assessments. Sections 42(1) and (5), in particular, state: 


(1) A worker who suffers permanent impairment as a result of an injury is 
entitled to receive compensation for non-economic loss in addition to any other 


benefit receivable under this Act. 


(5) The Board shall determine in accordance with the prescribed rating 
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schedule and having regard to medical assessments conducted under this section 
the degree of a worker’s permanent impairment expressed as a percentage of total 
permanent impairment. 


Based on the above provisions of the WCA, it is our view that conducting a NEL medical 
assessment to determine the compensation due to a worker who has suffered permanent 
impairment as a result of an injury, is a lawfully authorized activity. 


With regard to whether the collection of information concerning a worker’s sexual life is 
"necessary" to conducting NEL assessments, the Board advised us of the following. 


The Board stated that when considering the amount of compensation for a NEL award, it is 
important that a psychiatrist fully assess four areas of functioning, in determining the severity 
of impairment for the purposes of determining an award in cases of Chronic Pain Disability. 


The Board has adopted the American Medical Association (AMA) Guides to the Evaluation of 
Permanent Impairment. These areas are: 


1) Activities of Daily Living 

2) Social Functioning 

3) Concentration, persistence and pace 

4) Ability to adapt to stress circumstances. 


The Board explained that the more comprehensive the examination of these areas, the more 
accurate the evaluation of the extent of the impairment. Under Activities of Daily Living, the 
AMA Guides specify this to include activities such as "self care and personal hygiene, 
communication, ambulation, attaining all normal living posture, travel, non specialized hand 
activities, sexual function, social and recreational activities". The Guides also state that "what 
is assessed is not simply the number of activities that are restricted but the overall degree of 
restrictions or combination of restrictions". It is in this context that questions are asked by the 
physician about a worker’s sexual life. It is an aspect of functioning that can be impaired by 
a worker’s injury. If it is impaired, then the worker’s award should reflect that impairment in 
the context of his/her functioning in this and all the other areas examined. 


The Board stressed that it is important to understand that this is an extensive evaluation of the 
impact of the worker’s pain on his or her everyday life, and not just his/her work. This allows 
for compensation for changes from pre-accident levels of functioning. While sexual function 
may be a more sensitive area that is being assessed, it is no less important than the many other 
activities being examined to arrive at an award. In short, questions of a sexual nature are 
necessary to conduct a thorough assessment. 


Based on the above, it is our view that the Board had the authority to collect the information 
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concerning the complainant’s sexual life, as it was necessary to the proper administration of a 
lawfully authorized activity, that being, the conduct of a NEL medical assessment to determine 
appropriate compensation. Thus, the Board collected the complainant’s personal information in 
accordance with section 38(2) of the Act. 


Conclusion: The Board had the authority to collect the personal information, in 
accordance with section 38(2) of the Act. 
Issue C: Was the personal information disclosed in accordance with section 42 of the 


Act? 


The complaint concerns disclosure to a) the complainant’s employer, and b) the complainant’s 
former representative in her claim with the Board. 


Disclosure to the Employer 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 42. 


Section 42(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act 
of Parliament or a treaty, agreement or arrangement thereunder; 
(emphasis added) 


The Board cited section 42(12) of the WCA as its legislative authority for disclosure to the 
employer, in accordance with section 42(e) of the Act. 


Section 42(12) of the WCA requires the Board to send a copy of the NEL to the accident 
employer. It states: 


(12) The Board shall send a copy of the medical assessment conducted under 
subsection (9) to the worker and to the employer who employed the worker on 
the date of the injury. 


In our view, the Board’s disclosure of the complainant’s personal information to the employer 


was in accordance with section 42(e) of the Act, for the purpose of complying with an Act of 
the Legislature. 
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Disclosure to the Complainant’s Former Representative 


Injured workers may elect to have a representative of their choosing represent them in claims 
with the Board. Despite a letter on the Board’s file from the complainant dated June 11, 1992, 
advising that she had replaced her representative, the Board acknowledged that it had faxed a 
copy of the NEL to the complainant’s former representative. 


However, in support of this disclosure, the Board stated that the complainant had changed her 
representative on several occasions, and that the former representative had telephoned the NEL 
Manager, requesting a copy of the NEL. 


We were advised by the Board that it is the responsibility of the Adjudicator to make updates 
such as a change of representative on the "PARS" computer system. A clerk accesses "PARS" 
to obtain the address of the representative. In this case, it appears that the computer was not 
updated in a timely fashion. As a result, a disclosure to the complainant’s former representative 


was made in error. 


We examined section 42(b) of the Act with respect to this disclosure. This section states: 


An institution shall not disclose personal information in its custody or under its 
control except 


(b) where the person to whom the information relates has identified 
that information in particular and consented to its disclosure; 


However, we are of the view that the complainant did not identify the personal information and 
consent to its disclosure to her former representative. In our view, the Board’s disclosure of the 
complainant’s personal information to her former representative was not in accordance with 
section 42(b), or with any other provisions of section 42 of the Act. 


Conclusion: The Board’s disclosure of the NEL to the employer was in accordance 
with section 42 of the Act. 


The Board’s disclosure of the NEL to the complainant’s former 
representative was not in accordance with section 42 of the Act. 


Other Matters 


During the course of this investigation, the following matters were identified which should be 
brought to the Board’s attention. 
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Mailing Procedures for NELs 


We asked the Board about the manner in which NELs are sent to employers. We were advised 
that employers’ mailing addresses are identified on the computer system. If the employer has 
designated a named individual for its correspondence on a claim, the Adjudicator will update the 
system to state attention to this individual and the NEL would be sent, addressed accordingly. 
Accompanying the NEL is a cover letter reminding the employer of its obligation under the 
WCA to not disclose the information. Confidential envelopes are not used. 


We are concerned that the Board does not use confidential envelopes when mailing NELs to 
employers, and that where an appropriate official has not been identified, sensitive medical 
information may be viewed unnecessarily by the employer’s staff, eg. individuals responsible 
for opening and delivering the employer’s mail. 


Faxing of the NEL 


While this complaint did not concern the improper disclosure of personal information through 
the faxing of the NEL, we nonetheless wish to simply remind the Board of our faxing 
guidelines, since it is evident from the circumstances of this complaint that the Board has used 
a facsimile machine to transmit sensitive personal information. Accordingly, we have enclosed 
a copy of the following documents: "Guidelines on Facsimile Transmission Security, June 
1989" and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990". 


SUMMARY OF CONCLUSIONS 


e The information contained in the NEL was personal information as defined in section 
2(1) of the Act. 


e The Board had the authority to collect the personal information, in accordance with 
section 38(2) of the Act. 


e The Board’s disclosure of the NEL to the employer was in accordance with section 42 
of the Act. 
e The Board’s disclosure of the NEL to the complainant’s former representative was not 


in accordance with section 42 of the Act. 
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RECOMMENDATIONS 


L We recommend that the Board take steps to ensure that adjudicators update the 
information in their computers as soon as they are notified of a change of representative; 
for example, by sending a memorandum to appropriate staff, i.e. adjudicators and their 
supervisors to remind them of this procedure. 


De We recommend that the Board use confidential envelopes when mailing out medical 
information to employers. The envelopes should be addressed to a named officer, where 
this individual has been identified by the employer. If an officer has not been 
designated, a generic title should be used, for example, "WCB Claims Administrator". 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: November 26, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the 
Attorney General, Police Complaints Commissioner (previously known as the Public Complaints 
Commissioner). : 


The complainant wrote a letter to the Chief of Police of Metropolitan Toronto in December of 
1990. In the letter, she complained about the conduct of police officers, and the conduct of two 
doctors. The Deputy Chief of Police sent a copy of her letter to the Police Complaints 
Commissioner (the PCC), because the complaint involved police officers. However, the 
Metropolitan Toronto Police Force Complaint Act was not in effect at the time of the incidents 
involving the police officers, so the complaints about the police were not within the jurisdiction 
of the PCC. The PCC wrote to the Director of Investigations of the College of Physicians and 
Surgeons of Ontario (the College), enclosing a copy of the complainant’s letter (with the names 
of the police officers severed), and a copy of the letter from the Deputy Chief of Police. 


The Police Complaints Commissioner then wrote to the Deputy Chief of Police explaining that 
the complaints did not fall within his jurisdiction, stating that a copy of the complainant’s letter 
had been sent to the College. The Police Complaints Commissioner also wrote to the 
complainant on December 19, 1990, explaining that her complaint did not fall under his 
jurisdiction. However, this letter did not mention that a copy of the complaint letter had been 
forwarded to the College. 


Later, the College investigated the complaints about the doctors, and the complainant appealed 
the College’s decision to the Health Disciplines Board (the Board). The Board received a copy 
of the College’s file containing the copies of the complainant’s letter and the letters from the 
Deputy Chief of Police and the PCC. When the complainant asked the Board for disclosure of 
records, she found copies of the correspondence, and believed that her privacy had been 
breached by the disclosure of her letter by the PCC to the College. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 
(A) Did the complainant’s letter contain her “personal information", as defined in 
section 2(1) of the Freedom of Information and Protection of Privacy Act (the 
Act)? 


If the answer to the above question is yes, 
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(B) | Was the personal information disclosed by the PCC in accordance with section 
42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Did the complainant’s letter contain her "personal information", as defined 
in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, but not limited to, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the 
individual has been involved, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 
(e) the personal opinions or views of the individual except where they 


relate to another individual, 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the disclosure of the 
name would reveal other personal information about the individual; 


In our view, the letter from the complainant contained recorded information about her. Most 
of this recorded information fell into two main categories: 


1. information related to her complaints about the police; 
2. information related to her complaints about the doctors. 


The letter also contained other recorded information about the complainant that did not fall into 
either of these categories. 
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The recorded information about the complainant which related to her complaints about the 
police included: 


e her view that she had been denied proper service and protection by the police; 

e the fact that she had made previous complaints to the "Public Complaints Department"; the 
results of those complaints; 

e the fact that she was arrested by the police for trespassing, and that she had to 20 to court; 

e the fact that she was removed by the police from an alderman’s office, from a mental health 
rehabilitation centre, and from a hospital; 

e the fact that she felt harassed by the police and had made enquiries about how the police 
approached her. 


In our view, the above information meets the definition of "personal information" in section 
2(1) of the Act (i.e. recorded information about an identifiable individual). 


The recorded information about the complainant which related to her complaints about the 
doctors included: 


e the fact that she had been hospitalized at a named hospital on certain dates; 

e her view that she had not been treated in a professional manner by two doctors, and her 
account of what had taken place at the hospital; 

¢ the fact that "medical affairs" at the hospital refused to investigate her complaints; 

e the fact that a certain drug had been prescribed for her. 


In our view, the above information meets the definition of "personal information" in section 2(1) 
of the Act (i.e. recorded information about an identifiable individual). 


Other recorded information about the complainant that was not related to her complaints 
about the police or doctors included: 


e the fact that the complainant was facing eviction from her home, and that she was to appear 
in court; 

e her view that she felt pressured on all sides; 

e her name and address; 

e the fact that she had made complaints about personnel at a mental health rehabilitation centre. 


In our view, the above information meets the definition of "personal information" in section 2(1) 
of the Act (i.e. recorded information about an identifiable individual). 


In summary, the complainant’s letter contained her personal information, relating to her 
complaints about the police and the doctors, and also contained other recorded information about 
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her, not related to either of these complaints. In our view, this recorded information meets the 
definition of personal information in section 2(1) of the Act. 


Conclusion: The complainant’s letter contained her "personal information" as defined 
in section 2(1) of the Act. 


Issue B: Was the personal information disclosed by the PCC in accordance with 
section 42 of the Act? 


Section 42 of the Act sets out the rules for disclosure of personal information other than to the 
individual to whom the information relates. This section provides that an institution shall not 
disclose personal information in its custody or under its control, except in the circumstances 
listed in paragraphs-(a) through (p). We have examined the provisions of these sections, and 
determined that only paragraph 42(c) applied to the disclosure of the personal information in the 
circumstances of this case. Section 42(c) states: 


An institution shall not disclose personal information in its custody or 
under its control except, 


(c) for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


In determining whether the Act was breached, we considered the two main categories of personal 
information contained in the letter (i.e. information relating to the complaints about the police 
and information relating to the complaints about the doctors), as well as the other recorded 
information about the complainant that did not fall into these two categories. 


The complainant believed that the disclosure of the letter containing her personal information 
by the PCC to the College breached her privacy. The PCC’s position was that the letter had 
been disclosed in accordance with section 42(c) of the Act, for a consistent purpose. In our 
view, in order for the disclosure to have been made for a consistent purpose, the disclosure must 
be reasonably compatible with the purpose for which the personal information was obtained or 
compiled. 


In response to our draft report, the complainant stated her view that there was no consistent 
purpose in the PCC’s disclosing her letter to the College. She went on to say that the action of 
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the PCC was of no benefit to the College, that the College was not assisted by the efforts of the 
PCC and that she did not believe any investigation of her complaints about medical personnel 
was done by the PCC. However, in our view, the PCC could not control how the matter of the 
complaints might eventually be handled by the College, or whether the complainant might 
ultimately be satisfied with the results. Therefore, although we have carefully considered the 
complainant’s position, in our view, the situation at the time the letter was forwarded to the 
College is the situation that we must consider in determining whether the disclosure was made 
for a consistent purpose. i 


The situation at the time the letter was forwarded to the College was that the complainant’s letter 
was originally sent to the PCC by the Deputy Chief of Police for the purpose of having the PCC 
investigate the complaints that were contained in the letter. Therefore, the PCC obtained the 
letter for the purpose of investigating the complaints. 


In our view, the disclosure of the complainant’s personal information relating to her complaints 
about the doctors was reasonably compatible with the purpose for which the PCC obtained the 
complaint letter. The PCC had originally received the letter in order to investigate her 
complaints, and the College had the jurisdiction to investigate the complaints about the doctors. 
Since we find that the disclosure of the complainant’s personal information relating to the 
complaints about the doctors was reasonably compatible with the purpose for which the personal 
information was obtained, we find that the disclosure was made in accordance with section 42(c) 
of the Act, for a consistent purpose. 


Although the PCC was unable to investigate the complaints, because they were not within the 
PCC’s jurisdiction, the PCC was aware that another investigative body (the College) had the 
jurisdiction to investigate complaints about doctors, and therefore, the PCC forwarded the letter 
of complaint to the College. 


However, the College, as we understand its mandate, does not have the jurisdiction to investigate 
complaints about police officers. Therefore, in our view, the disclosure of the complainant’s 
personal information relating to her complaints about the police was not reasonably compatible 
with the purpose for which the PCC obtained the letter. Since we find that the disclosure of the 
complainant’s personal information relating to her complaints about the police was not 
reasonably compatible with the purpose for which the personal information was obtained, we 
find that the disclosure was not made in accordance with section 42(c) of the Act, for a 
consistent purpose. 


Similarly, we find that the disclosure of the personal information relating to other matters, such 
as the complainant’s being evicted, and her view that she felt pressured, was not reasonably 
compatible with the purpose for which the personal information was obtained, since the College 
could not investigate these matters. Since we find that these disclosures were not reasonably 
compatible with the purpose for which the personal information had been obtained, we find that 
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these disclosures were not made in accordance with the section 42(c) of the Act, for a consistent 
purpose. 


In response to our draft report, the complainant stated her view that her name and address were 
not disclosed to the College by the PCC in accordance with the Act. We have carefully 
considered the complainant’s view, including whether her complaint could have effectively been 
dealt with had her identity remained anonymous. However, in our view, the College would 
need to be able to identify the complainant and contact her to respond to her complaints. As 
mentioned previously, we have considered the situation at the time the letter was forwarded 
in taking this view. 


The purpose for which the College had obtained the complainant’s name and address was to 
identify her, and respond to her complaint. Therefore, we find that the disclosure of the 
complainant’s name and address to the College was reasonably compatible with the purpose for 
which it had been obtained by the PCC, which was to identify the complainant, and respond to 
her concerns. Since we find that the disclosure of the complainant’s name and address was 
reasonably compatible with the purpose for which the personal information was obtained, we 
find that the disclosure was made in accordance with section 42(c) of the Act, for a consistent 


purpose. 


Conclusions: The personal information relating to the complaints about the doctors was 
disclosed by the PCC in accordance with section 42 of the Act. 


The personal information relating to the complaints about the police was 
not disclosed by the PCC in accordance with section 42 of the Act. 


The personal information not relating to the complaints about the police 
or doctors was not disclosed by the PCC in accordance with section 42 of 
the Act. 


The complainant’s name and address were disclosed by the PCC in 
accordance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 

° The complainant’s letter contained her "personal information" as defined in section 2(1) 
of the Act. 

° The personal information relating to the complaints about the doctors was disclosed by 


the PCC in accordance with section 42 of the Act. 
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The personal information relating to the complaints about the police was not disclosed 
by the PCC in accordance with section 42 of the Act. 


The personal information not relating to the complaints about the police or doctors was 
not disclosed by the PCC in accordance with section 42 of the Act. 


The complainant’s name and address were disclosed by the PCC in accordance with 
section 42 of the Act. ; 


RECOMMENDATIONS 


In making our recommendations, we acknowledge that the PCC forwarded the complainant’s 
complete letter to the College with the intention of providing a service to the complainant (i.e. 
to try to ensure that her complaints were brought to the attention of the proper investigative 
body). We also acknowledge that the PCC severed the names of the police officers from the 
letter, with a view to protecting their privacy. 


We recommend the following procedures be incorporated into the PCC’s complaint process: 


1. 


that when the PCC receives a complaint and forwards it to another investigative body 
with the proper jurisdiction to investigate the complaint, the PCC sever any personal 
information that is not related to the complaint and is not necessary to the proper 
administration of the complaint; 


that the PCC advise individuals if their complaints are being forwarded to another 
investigatory body. 


Within six months of receiving this report, the PCC should provide our Office with proof of 
compliance with the above recommendations. 


Original signed by: August 31, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a board of education (the 
Board). 


The complainant wrote that she had filed access requests with the Board, pursuant to the 
provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act). 


She complained that the Board, on receipt of her access requests, had "investigated" her and 
found out her first name and sex. She complained that the Board had then wrongly disclosed 
her first name and sex to its law firm. The complainant discovered this disclosure when the law 
firm wrote her two letters, using her first name and "Ms" which indicated that she was female. 
The complainant wrote that she had never disclosed her first name or her sex in her access 
requests. 


The Board had previously informed her that its Freedom of Information and Protection of 
Privacy Co-ordinator (the Co-ordinator) was deceased. However she felt that the Board should 


have replaced the Co-ordinator, rather than sending her access requests to the Board’s law firm 
for reply. 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Board "investigate" the complainant when it collected her personal 
information? 


(C) Was the disclosure by the Board in accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 
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Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
sex, sexual orientation or marital or family status of the individual, 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; ("renseignements personnels") 


The complainant sent us copies of the two letters that she had received from the law firm, 
concerning her access requests. These two letters had been addressed to her as "Ms" and 
contained her first name. 


In our view, the information contained in these two letters (her first name and her sex) met the 
requirements in paragraphs (a) and (h) of the definition of personal information in section 2(1) 
of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Did the Board "investigate" the complainant when it collected her personal 
information? 


The complainant wrote that she had never referred to herself either by her first name or "Ms" 
in any correspondence with the Board. As a result, she complained that the Board must have 
investigated her to determine her first name and her sex. The Board denied conducting any 
investigation as suggested by the complainant. 


The Board replied that the complainant had provided her access requests in two envelopes which 
were addressed to the Director of Education with the notation "Private and Confidential to be 
opened only by the Director of Education". Neither envelope contained any indication that they 
contained access requests. However, inside one of the envelopes was a letter dated August 8, 
1993 to the Director of Education referring to access requests. This letter was signed by the 
complainant and contained the complainant’s first name in full. The Board advised us that its 
lawyer had concluded that the name contained in the letter was that of a woman and had 
addressed the complainant as "Ms". The Board stated that the use of "Ms" was a social courtesy 
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which is standard with correspondence. 


The Board provided us with a copy of the letter in question. It is our view that the complainant 
herself disclosed her first name and sex in her letter to the Board. 


Conclusion: We found no evidence that the Board had "investigated" the complainant 
when it collected her personal information. 


Issue C: Was the disclosure by the Board in accordance with section 32 of the Act? 


Under the Act, personal information in the custody or control of an institution cannot be 
disclosed except in the specific circumstances outlined in section 32. 


The Board stated that it had relied on section 32(c) of the Act for this disclosure. Section 32(c) 
of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


The Board advised that, at the time of the complainant’s access requests, the original Co- 
ordinator had recently been deceased. The Board had asked the Board’s lawyer (at the law firm) 
to assist the Board in the interim pending the appointment of a replacement. This lawyer had 
been continually responsible for providing advice to the Board with respect to matters concerning 
the Act. 


At the time the Board received the complainant’s access requests, the lawyer was the acting Co- 
ordinator. The Board therefore provided the complainant’s documents to the lawyer to review, 
provide advice and assist the Board in responding to her access requests. 


The complainant also wrote that her personal information (her name) had been disclosed to a 
[named] law clerk at the same law firm. In the lawyer’s reply to the complainant, he told her 
that he would be away for a certain period of time. During this time, he advised her that she 
could correspond with the law clerk. 


It is our view that the Board disclosed the complainant’s personal information to the lawyer for 


the same purpose for which it had been collected - namely, to respond to the access requests. 
The lawyer was the Board’s acting Co-ordinator at that time, and thus the Board had to disclose 
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the complainant’s access requests to him so that he could respond to these requests. 
It is also our view that the lawyer disclosed the complainant’s name to the law clerk for the same 


purpose for which the personal information had been collected - namely, to respond to the access 
requests while the lawyer was absent. 


Conclusion: The disclosure of the personal information by the Board was in accordance 
with section 32(c) of the Act. 


SUMMARY OF CONCLUSIONS 


6 The information in question was "personal information", as defined in section 2(1) of the 
Act. 

e We found no evidence that the Board "investigated" her when it collected her personal 
information. 

@ The disclosure of the personal information by the Board was in accordance with section 


32(c) of the Act. 


Oniginal signed by: December 14, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a board of education (the 
Board). 


The complainant wrote that she had filed access requests with the Board, pursuant to the 
provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act). 


She complained that the Board, on receipt of her access requests, had "investigated" her and 
found out her first name and sex. She complained that the Board had then wrongly disclosed 
her first name and sex to its law firm. The complainant discovered this disclosure when the law 
firm wrote her two letters, using her first name and "Ms" which indicated that she was female. 
The complainant wrote that she had never disclosed her first name or her sex in her access 
requests. 


The Board had previously informed her that its Freedom of Information and Protection of 
Privacy Co-ordinator (the Co-ordinator) was deceased. However she felt that the Board should 


have replaced the Co-ordinator, rather than sending her access requests to the Board’s law firm 
for reply. 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Board "investigate" the complainant when it collected her personal 
information? 


(C) Was the disclosure by the Board in accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 
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Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
sex, sexual orientation or marital or family status of the individual, 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; ("renseignements personnels") 


The complainant sent us copies of the two letters that she had received from the law firm, 
concerning her access requests. These two letters had been addressed to her as "Ms" and 
contained her first name. 


In our view, the information contained in these two letters (her first name and her sex) met the 


requirements in paragraphs (a) and (h) of the definition of personal information in section 2(1) 
of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Did the Board "investigate" the complainant when it collected her personal 
information? 


The complainant wrote that she had never referred to herself either by her first name or "Ms" 
in any correspondence with the Board. As a result, she complained that the Board must have 
investigated her to determine her first name and her sex. The Board denied conducting any 
investigation as suggested by the complainant. 


The Board replied that the complainant had provided her access requests in two envelopes which 
were addressed to the Director of Education with the notation "Private and Confidential to be 
opened only by the Director of Education". Neither envelope contained any indication that they 
contained access requests. However, inside one of the envelopes was a letter dated August 8, 
1993 to the Director of Education referring to access requests. This letter was signed by the 
complainant and contained the complainant’s first name in full. The Board advised us that its 
lawyer had concluded that the name contained in the letter was that of a woman and had 
addressed the complainant as "Ms". The Board stated that the use of "Ms" was a social courtesy 
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which is standard with correspondence. 


The Board provided us with a copy of the letter in question. It is our view that the complainant 
herself disclosed her first name and sex in her letter to the Board. 


Conclusion: We found no evidence that the Board had "investigated" the complainant 
when it collected her personal information. 


Issue C: Was the disclosure by the Board in accordance with section 32 of the Act? 


Under the Act, personal information in the custody or control of an institution cannot be 
disclosed except in the specific circumstances outlined in section 32. 


The Board stated that it had relied on section 32(c) of the Act for this disclosure. Section 32(c) 
of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


The Board advised that, at the time of the complainant’s access requests, the original Co- 
ordinator had recently been deceased. The Board had asked the Board’s lawyer (at the law firm) 
to assist the Board in the interim pending the appointment of a replacement. This lawyer had 
been continually responsible for providing advice to the Board with respect to matters concerning 
the Act. 


At the time the Board received the complainant’s access requests, the lawyer was the acting Co- 
ordinator. The Board therefore provided the complainant’s documents to the lawyer to review, 
provide advice and assist the Board in responding to her access requests. 


The complainant also wrote that her personal information (her name) had been disclosed to a 
[named] law clerk at the same law firm. In the lawyer’s reply to the complainant, he told her 
that he would be away for a certain period of time. During this time, he advised her that she 
could correspond with the law clerk. 


It is our view that the Board disclosed the complainant’s personal information to the lawyer for 


the same purpose for which it had been collected - namely, to respond to the access requests. 
The lawyer was the Board’s acting Co-ordinator at that time, and thus the Board had to disclose 
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the complainant’s access requests to him so that he could respond to these requests. 
It is also our view that the lawyer disclosed the complainant’s name to the law clerk for the same 


purpose for which the personal information had been collected - namely, to respond to the access 
requests while the lawyer was absent. 


Conclusion: The disclosure of the personal information by the Board was in accordance 
with section 32(c) of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information", as defined in section 2(1) of the 
Act. 

e We found no evidence that the Board "investigated" her when it collected her personal 
information. 

e The disclosure of the personal information by the Board was in accordance with section 


32(c) of the Act. 


Original signed by: December 14, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning one of the Ministry of 
Health’s psychiatric hospitals (the Hospital). 


For medical reasons, the complainant, an employee of the Hospital, requested employment 
accommodation under the Employment Equity Program. The accommodation would enable her 
to continue to work in her capacity at the Hospital. During the course of arranging the 
complainant’s accommodation needs, the complainant’s supervisor, the Director of Psychology 
(the Director), disclosed the complainant’s medical diagnosis to certain Hospital staff. 


The complainant was concerned about the disclosures of this personal information, stating that 
they were contrary to the Freedom of Information and Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Were the Director’s disclosures of the complainant’s personal information in 
accordance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name if it appears with other personal information relating 
to the individual... 


The complainant’s counsel (the Counsel) provided a number of documents which identified the 
complainant by name together with information about her medical condition. Two of these 
documents were memoranda. One, dated November 6, 1991, was written by the Director to the 
Director, Materials Management, and copied to the Assistant Administrator, Clinical Services 
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(the Assistant Administrator). The other, dated June 30, 1992, was written by the Director to 
the complainant and copied to the Assistant Administrator, the Employment Equity Advisor, and 
the Personnel department. 


After reviewing the documents provided, it is our view that they contained information which 
met the requirements in paragraph (h) of the definition of personal information in section 2(1) 
of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Were the Director’s disclosures of the complainant’s personal information in 
accordance with section 42 of the Act? 


We determined that, of the documents provided by the Counsel, only the two memoranda 
disclosed the complainant’s personal information to Hospital staff. 


While the complainant stated that the Director had also disclosed a doctor’s note to the 
Employment Equity Advisor even after "confirming that she [the Director] would not invade my 
[the complainant’s] privacy", the information provided by Counsel did not support that such a 
disclosure took place. In addition, the Hospital submitted that the Director stated that she did 
not remember disclosing the doctor’s note, and the Employment Equity Advisor did not recall 
seeing such a doctor’s note and did not have a copy of any such note in her files. 


Under the Act, personal information in the custody or control of an institution can not be 
disclosed except in the specific circumstances outlined in section 42. 


With respect to the Director’s disclosure of the complainant’s personal information in the 
memorandum dated November 6, 1991, to the Director, Materials Management, and the 
Assistant Administrator, and the disclosure in the memorandum dated June 30, 1992, to the 
Assistant Administrator, the Employment Equity Advisor, and the Personnel department, the 
Hospital stated that it had relied on section 42(d) of the Act for both of these disclosures. 


Section 42(d) states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) — where disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and where 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


The Hospital submitted that each of the employees to whom the complainant’s personal 
information was disclosed, needed the information in the performance of his or her duties. 
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Specifically, the Assistant Administrator, as the supervisor of the Director, needed the personal 
information to support the complainant’s request for accommodation. The Employment Equity 
Advisor, as the Hospital’s liaison person with Employment Equity, needed the information in 
order to advocate for the complainant’s need for accommodation and to communicate with the 
Employment Equity Co-ordinator’s Office in the Ministry of Health. The Hospital advised that 
the Employment Equity Advisor was the same person as the Director, Materials Management. 


With respect to the disclosure to staff in the Personnel department, the Hospital stated that its 
Personnel or Human Resources department had a role in supporting the needs of employees, 
such as, in this case, employee accommodation. For the purpose of maintaining employee files, 
Personnel department staff required a copy of the memoranda containing the personal 
information in question. 


The Hospital maintained that, therefore, the Director’s disclosures of the complainant’s medical 
diagnosis to the above parties were in accordance with section 42(d) of the Act since they needed 
the information in order to perform their duties, i.e. to plan the accommodation needs of the 
complainant. 


In our view, providing for the accommodation needs of an employee under the Employment 
Equity Program was an administrative function of the Hospital. As a part of this function, the 
Assistant Administrator had the responsibility of ensuring that the complainant’s accommodation 
needs were met and of approving the purchase of necessary equipment. In order to be able to 
do so, he needed the complainant’s medical information. It is, therefore, our view that the 
disclosures in the two memoranda of the complainant’s medical information to the Assistant 
Administrator, as the Director’s supervisor, were to an officer who needed the information in 
the performance of his duties and the disclosures were necessary and proper in the discharge of 
one of the Hospital’s administrative functions. Therefore, the disclosures to the Assistant 
Administrator were in accordance with section 42(d) of the Act. 


However, it is our view that the disclosure in the November 6, 1991 memorandum to the 
Director, Materials Management, was not in accordance with section 42(d) of the Act. The 
memorandum sent to the Director, Materials Management, by the Director was for the purpose 
of purchasing the necessary accommodation equipment for the complainant. It is our view that 
the Director, Materials Management, did not need to know any details of the complainant’s 
medical condition in order to purchase equipment which had already been noted in an attached 
purchase order. In addition, while the Hospital advised that the Director, Materials 
Management, and the Employment Equity Advisor were the same person, this was not the case 
in November 1991 when the disclosure occurred. The role of Employment Equity Advisor was 
a special assignment that was not assumed by the Director, Materials Management, until the 
spring of 1992. 


It is also our view that the disclosure of the complainant’s medical diagnosis in the June 30, 
1992 memorandum to the Personnel department was not in accordance with section 42(d) of the 
Act. The Hospital stated that the disclosure was necessary since the Personnel department had 
a role in supporting the needs of the complainant and in maintaining employee records. In our 
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view, it was unnecessary for the complaint’s specific medical diagnosis to be disclosed to the 
Personnel department in order for the department to support her accommodation needs or to 
maintain records. Therefore, in our view, the disclosure to staff in the Personnel department 
was not a disclosure to an officer or employee who needed the complainant’s medical 
information in the performance of his or her duties and was, therefore, not in accordance with 
section 42(d) of the Act. 


With respect to the disclosure of the June 30, 1992 memorandum to the Director, Materials 
Management, in her capacity as Employment Equity Advisor, it is our view that the disclosure 
was also not in accordance with section 42(d) of the Act. At that time, the Employment Equity 
Advisor was not yet involved in the accommodation process. It was not necessary for her to 
communicate with the Employment Equity Co-ordinator’s Office in the Ministry of Health since 
she was not at that time, advocating for the complainant’s accommodation needs. Therefore, 
in our view, the disclosure of the complainant’s medical diagnosis in the June 30, 1992 
memorandum to the Employment Equity Advisor was, at that time, not a disclosure to an officer 
who need the information in the performance of her duties and therefore, it was not in 
accordance with section 42(d) of the Act. 


In our view, except for the disclosures to the Assistant Administrator, the disclosures of the 
complainant’s medical information were not in accordance with section 42(d) of the Act. In our 
view, no other provisions of section 42 applied to the disclosures. 


Conclusion: The disclosures of the complainant’s medical information to the Assistant 
Administrator, were in accordance with section 42 of the Act. 


The disclosures of the complainant’s medical information to staff in the 
Personnel department, to the Director, Materials Management both as the 
Director, Materials Management and in her capacity as Employment 
Equity Advisor were not in accordance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The disclosures of the complainant’s medical information to the Assistant Administrator, 


were in accordance with section 42 of the Act. 


The disclosures of the complainant’s medical information to staff in the personnel 
department, to the Director, Materials Management both as the Director, Materials 
Management and in her capacity as Employment Equity Advisor were not in accordance 
with section 42 of the Act. 
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RECOMMENDATIONS 
We recommend that the Ministry: 


1. take steps to ensure that Hospital staff are aware of the limited purposes for which the 
disclosure of personal information is permitted under the Act. 


pas establish a guideline which sets out the steps to be taken by Hospital Staff when 
processing an application for employee accommodation under the Employment Equity 
Program. The guideline should clearly set out to whom an applicant’s personal medical 
information may be disclosed. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original sgqned by: November 23, 1993 
Susan Anthistle Date 


Manager of Compliance 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named municipality (the 
Municipality). 


The complainant, an employee of the Municipality, had been in receipt of Workers’ 
Compensation Board (WCB) benefits for a workplace injury suffered in September 1989. In 
December 1989, while he was off work recuperating from his injury, the complainant was in 
a car accident. This accident involved coincidentally a Municipality vehicle. The complainant 
subsequently filed a civil suit against the Municipality for damages. Since the accident involved 
one of its vehicles bumping the complainant’s car, the Municipality contacted the insurance 
company which acted as its agent in third party claims involving Municipality vehicles. 


In a letter dated March 20, 1992 to the Municipality, the insurance company requested the 
opportunity of reviewing the complainant’s personnel file - specifically any Workers’ 
Compensation Board (WCB) claims. The insurance company stated that it was investigating a 
"bodily injury claim" submitted by the complainant against the Municipality. The insurance 
company was concerned that the complainant’s claim for injuries might involve any prior and 
similar WCB injuries. 


In a letter dated April 23, 1992 to the insurance company, the Municipality provided the 
insurance company with documentation which it considered relevant to the complainant’s 
September 1989 WCB claim. 


After the insurance company had asked the Municipality for a copy of the complainant’s WCB 
claim but before the Municipality responded, the insurance company received a copy of the 
complainant’s WCB file from the complainant’s lawyer on April 7, 1992. The insurance 
company did not advise the Municipality that it had already received this copy of the 
complainant’s WCB records. 


The complainant contended that the Municipality’s disclosure of his WCB records to the 
insurance company was contrary to the Municipal Freedom of Information and Protection of 
Privacy Act (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 
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(B) Did the Municipality disclose the complainant’s personal information, in 
accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 


recorded information about an identifiable individual, including, 


(c) any identifying number, symbol or other particular assigned to the 
individual, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; ("renseignements 
personnels") 


We obtained a copy of the documentation which the Municipality had disclosed to the insurance 
company. This documentation consisted of records pertaining to the complainant’s WCB claim 
dated September 10, 1989. These records contained, for example, information concerning the 
complainant’s medical condition, his WCB claim number, his Social Insurance Number, his 
driver’s licence number, his postal address, and information concerning a WCB overpayment. 


The documentation also included a record entitled "SKILLS INVENTORY" which outlined the 
following information concerning the complainant and eight other Municipality employees: 
various subjects that the employees had been trained in on a particular date, the fact that all of 
the employees had successfully completed the training, the dates that the employees were 
returning to "Operations", and whether they were returning on days or nights. 


It is our view that the information contained in the documentation forwarded to the insurance 
company met the requirements of paragraphs (c), (d) and (h) of the definition of "personal 
information", in section 2(1) of the Act. 
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Conclusion: The information in question was “personal information", as defined in 
section 2(1) of the Act. 


Issue B: Did the Municipality disclose the complainant’s personal information, in 
accordance with section 32 of the Act? 


Initially, the Municipality stated that it had disclosed the complainant’s WCB claim to the 
insurance company in accordance with section 32(c) of the Act. However, the Municipality 
subsequently stated that the personal information was not disclosed. It stated, instead, that the 
personal information was used for a "purpose reasonably compatible with the purpose for which 
it was obtained or compiled, in accordance with s.31(b) of the Act". 


Section 31 of the Act outlines the general rules for the use of personal information in the 
custody or control of an institution. In the circumstances of this case, it is our view that since 
the records containing the personal information in question were forwarded to an organization 
external to the institution, the disclosure provisions of the Act, instead of the use provisions, 
more appropriately apply. 


Section 32 of the Act prohibits the disclosure of personal information by an institution, except 
in certain circumstances. Section 32(c) of the Act, which the Municipality had originally relied 
upon, states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


In our view, one of the purposes for which the Municipality obtained the complainant’s WCB 
claim was for WCB claims management. However, the Municipality disclosed the complainant’s 
WCB information to the insurance company not for this purpose, but to assist the insurance 
company with its investigation in respect of the complainant’s suit for damages against the 
Municipality. It is, thus, our view that the Municipality’s disclosure of the complainant’s 
personal information to the insurance company was not “for the purpose for which it was 
obtained or compiled", in accordance with section 32(c) of the Act. 


Section 32(c) also states that personal information may be disclosed for a "consistent purpose". 
However, section 33 of the Act further provides that: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. (emphasis added) 
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In this case, however, the personal information was not collected directly from the complainant. 
When personal information has been collected indirectly, as in the circumstances of this case, 
a consistent purpose is one which is "reasonably compatible" with the purpose for which the 
personal information has been obtained or compiled. 


As we stated earlier, one of the purposes for which the complainant’s WCB claim had been 
obtained by the Municipality was for WCB claims management. In our view, the Municipality’s 
disclosure of the complainant’s WCB claim to the insurance company for the purpose of 
addressing the civil suit was not reasonably compatible with WCB claims management. It is 
thus our view that the Municipality’s disclosure was not for a "consistent purpose", in 
accordance with section 32(c) of the Act. 


It is also our view that if the Municipality had not been coincidentally the complainant’s 
employer, the Municipality would not have had custody or control of the complainant’s WCB 
records and would not have been in a position to disclose these records. We acknowledge that 
in order for the civil suit to proceed, it would have been necessary eventually for the 
complainant or his representative to disclose these records to the insurance company. However, 
it is our view that it would not have been necessary for the complainant’s employer to be 
involved. 


We have reviewed the remaining exceptions under section 32 and found that none applied to the 
circumstances of this case. It is, therefore, our view that the Municipality disclosed the 
complainant’s personal information to the insurance company contrary to section 32 of the Act. 


Conclusion: The Municipality disclosed the complainant’s personal information 
contrary to section 32 of the Act. 


Other Matters 


During the course of this investigation, the following matters were identified which should be 
brought to the institution’s attention. 


Disclosure of the "SKILLS INVENTORY" 


We found that in addition to sending a copy of the complainant’s WCB records, the Municipality 
also disclosed a record entitled "SKILLS INVENTORY", to the insurance company. As 
previously mentioned, this record included details about training which the complainant and 
other Municipality employees had successfully completed. It also included details regarding the 
dates that the employees were returning to "Operations", and whether they were returning on 
days or nights. 
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We examined section 32 of the Act and found that none of the exceptions listed applied to this 
disclosure. Accordingly, it is our view that the Municipality’s disclosure of this personal 
information was contrary to section 32 of the Act. 


Conclusion: The Municipality disclosed the personal information contained in the 
"SKILLS INVENTORY" contrary to section 32 of the Act. 


Faxing of Personal Information 

While this complaint did not concern the improper disclosure of personal information by 
facsimile, we noticed that there was a facsimile cover sheet included in the records disclosed to 
the insurance company. Since it appeared that personal information might have been sent via 
facsimile, we reminded the Municipality of our faxing guidelines. We enclosed (with our draft 


report) copies of the following: "Guidelines on Facsimile Transmission Security, June 1989" 
and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990". 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information", as defined in section 2(1) of the 
Act. 


e The Municipality disclosed the complainant’s personal information contrary to section 32 
of the Act. 


® The Municipality disclosed the personal information contained in the "SKILLS 
INVENTORY" contrary to section 32 of the Act. 

RECOMMENDATIONS 

We recommend that the Municipality: 

he take steps to ensure that disclosures of personal information are made in accordance with 
the Act, for example, by clarifying any existing guidelines or procedures regarding 


disclosure of personal information; 


Ze remind its employees of our guidelines on the transmission of facsimiles. 
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Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: December 31, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named municipality (the 
Municipality). 


The complainant, an employee of the Municipality, had been in receipt of Workers’ 
Compensation Board (WCB) benefits for a workplace injury suffered in September 1989. In 
December 1989, while he was off work recuperating from his injury, the complainant was in 
a car accident. This accident involved coincidentally a Municipality vehicle. The complainant 
subsequently filed a civil suit against the Municipality for damages. Since the accident involved 
one of its vehicles bumping the complainant’s car, the Municipality contacted the insurance 
company which acted as its agent in third party claims involving Municipality vehicles. 


In a letter dated March 20, 1992 to the Municipality, the insurance company requested the 
opportunity of reviewing the complainant’s personnel file - specifically any Workers’ 
Compensation Board (WCB) claims. The insurance company stated that it was investigating a 
"bodily injury claim" submitted by the complainant against the Municipality. The insurance 
company was concerned that the complainant’s claim for injuries might involve any prior and 
similar WCB injuries. 


In a letter dated April 23, 1992 to the insurance company, the Municipality provided the 
insurance company with documentation which it considered relevant to the complainant’s 
September 1989 WCB claim. 


After the insurance company had asked the Municipality for a copy of the complainant’s WCB 
claim but before the Municipality responded, the insurance company received a copy of the 
complainant’s WCB file from the complainant’s lawyer on April 7, 1992. The insurance 
company did not advise the Municipality that it had already received this copy of the 
complainant’s WCB records. 


The complainant contended that the Municipality’s disclosure of his WCB records to the 
insurance company was contrary to the Municipal Freedom of Information and Protection of 
Privacy Act (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 
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(B) Did the Municipality disclose the complainant’s personal information, in 
accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 


recorded information about an identifiable individual, including, 


(c) any identifying number, symbol or other particular assigned to the 
individual, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal. information about the individual; ("renseignements 
personnels") 


We obtained a copy of the documentation which the Municipality had disclosed to the insurance 
company. This documentation consisted of records pertaining to the complainant’s WCB claim 
dated September 10, 1989. These records contained, for example, information concerning the 
complainant’s medical condition, his WCB claim number, his Social Insurance Number, his 
driver’s licence number, his postal address, and information concerning a WCB overpayment. 


The documentation also included a record entitled "SKILLS INVENTORY" which outlined the 
following information concerning the complainant and eight other Municipality employees: 
various subjects that the employees had been trained in on a particular date, the fact that all of 
the employees had successfully completed the training, the dates that the employees were 
returning to "Operations", and whether they were returning on days or nights. 


It is our view that the information contained in the documentation forwarded to the insurance 
company met the requirements of paragraphs (c), (d) and (h) of the definition of "personal 
information", in section 2(1) of the Act. 
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Conclusion: The information in question was "personal information", as defined in 
section 2(1) of the Act. 


Issue B: Did the Municipality disclose the complainant’s personal information, in 
accordance with section 32 of the Act? 


Initially, the Municipality stated that it had disclosed the complainant’s WCB claim to the 
insurance company in accordance with section 32(c) of the Act. However, the Municipality 
subsequently stated that the personal information was not disclosed. It stated, instead, that the 
personal information was used for a "purpose reasonably compatible with the purpose for which 
it was obtained or compiled, in accordance with s.31(b) of the Act”. 


Section 31 of the Act outlines the general rules for the use of personal information in the 
custody or control of an institution. In the circumstances of this case, it is our view that since 
the records containing the personal information in question were forwarded to an organization 
external to the institution, the disclosure provisions of the Act, instead of the use provisions, 
more appropriately apply. 


Section 32 of the Act prohibits the disclosure of personal information by an institution, except 
in certain circumstances. Section 32(c) of the Act, which the Municipality had originally relied 
upon, states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


In our view, one of the purposes for which the Municipality obtained the complainant’s WCB 
claim was for WCB claims management. However, the Municipality disclosed the complainant’s 
WCB information to the insurance company not for this purpose, but to assist the insurance 
company with its investigation in respect of the complainant’s suit for damages against the 
Municipality. It is, thus, our view that the Municipality’s disclosure of the complainant’s 
personal information to the insurance company was not "for the purpose for which it was 
obtained or compiled", in accordance with section 32(c) of the Act. 


Section 32(c) also states that personal information may be disclosed for a "consistent purpose". 
However, section 33 of the Act further provides that: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. (emphasis added) 
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In this case, however, the personal information was not collected directly from the complainant. 
When personal information has been collected indirectly, as in the circumstances of this case, 
a consistent purpose is one which is "reasonably compatible" with the purpose for which the 
personal information has been obtained or compiled. 


As we stated earlier, one of the purposes for which the complainant’s WCB claim had been 
obtained by the Municipality was for WCB claims management. In our view, the Municipality’s 
disclosure of the complainant’s WCB claim to the insurance company for the purpose of 
addressing the civil suit was not reasonably compatible with WCB claims management. It is 
thus our view that the Municipality’s disclosure was not for a "consistent purpose", in 
accordance with section 32(c) of the Act. 


It is also our view that if the Municipality had not been coincidentally the complainant’s 
employer, the Municipality would not have had custody or control of the complainant’s WCB 
records and would not have been in a position to disclose these records. We acknowledge that 
in order for the civil suit to proceed, it would have been necessary eventually for the 
complainant or his representative to disclose these records to the insurance company. However, 
it is our view that it would not have been necessary for the complainant’s employer to be 
involved. 


We have reviewed the remaining exceptions under section 32 and found that none applied to the 
circumstances of this case. It is, therefore, our view that the Municipality disclosed the 
complainant’s personal information to the insurance company contrary to section 32 of the Act. 


Conclusion: The Municipality disclosed the complainant’s personal information 
contrary to section 32 of the Act. 


Other Matters 


During the course of this investigation, the following matters were identified which should be 
brought to the institution’s attention. 


Disclosure of the "SKILLS INVENTORY" 


We found that in addition to sending a copy of the complainant’s WCB records, the Municipality 
also disclosed a record entitled "SKILLS INVENTORY", to the insurance company. As 
previously mentioned, this record included details about training which the complainant and 
other Municipality employees had successfully completed. It also included details regarding the 
dates that the employees were returning to "Operations", and whether they were returning on 
days or nights. 
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We examined section 32 of the Act and found that none of the exceptions listed applied to this 
disclosure. Accordingly, it is our view that the Municipality’s disclosure of this personal 
information was contrary to section 32 of the Act. 


Conclusion: The Municipality disclosed the personal information contained in the 
"SKILLS INVENTORY" contrary to section 32 of the Act. 


Faxing of Personal Information 


While this complaint did not concern the improper disclosure of personal information by 
facsimile, we noticed that there was a facsimile cover sheet included in the records disclosed to 
the insurance company. Since it appeared that personal information might have been sent via 
facsimile, we reminded the Municipality of our faxing guidelines. We enclosed (with our draft 
report) copies of the following: "Guidelines on Facsimile Transmission Security, June 1989" 
and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990". 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information", as defined in section 2(1) of the 
Act. 

e The Municipality disclosed the complainant’s personal information contrary to section 32 
of the Act. 


e The Municipality disclosed the personal information contained in the "SKILLS 
INVENTORY" contrary to section 32 of the Act. 

RECOMMENDATIONS 

We recommend that the Municipality: 

1: take steps to ensure that disclosures of personal information are made in accordance with 
the Act, for example, by clarifying any existing guidelines or procedures regarding 


disclosure of personal information; 


sd remind its employees of our guidelines on the transmission of facsimiles. 


[IPC Investigation 193-046M/December 31, 1993] 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: December 31, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a psychiatric hospital of 
the Ministry of Health (the Ministry). 


A hospital employee was concerned that the hospital was storing employee related injured 
worker information with regular patient information on a computer system that was accessible 
by other employees who did not need access to this information. He was also concerned that 
pay stubs were being distributed in an unsecured manner, and that employee time sheet printouts 
showing employees’ Social Insurance Numbers (SINs) were being sent to departments in an 
unsecured manner. 

The complainant believed that these practices were in contravention of the Freedom of 
Information and Protection of Privacy Act (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the "personal information" in accordance with section 42 
of the Act? 


(C) | Were reasonable measures in place to prevent unauthorized access to "personal 
information" in accordance with Regulation 460 under the Act, as amended by 
Regulation 532/93? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 2(1) 
of the Act? 


Section 2(1) of the Act states, in part: 
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"personal information" means recorded information about an_ identifiable 
individual, including, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


We have determined that injured worker information was comprised of the injured worker’s 
name, the type of injury, the amount of time away from work and whether a Workers’ 
Compensation Board (WCB) claim had been made. Pay stubs and time sheets contained the 
employee’s name and SIN. Pay stubs also contained salary details. 


We are of the view that this information met the requirements in paragraphs (b) and (h) of the 
definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 
Issue B: Was the disclosure of the "personal information" in accordance with section 42 


of the Act? 


Under the Act, personal information in the custody or under the control of an institution can not 
be disclosed except in the specific circumstances outlined in section 42. 


Pay Cheques/Pay Stubs 


The Ministry stated that it had relied on section 42(d) of the Act for the disclosure of personal 
information contained in the pay cheques/pay stubs. Section 42(d) states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) where disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and where 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 
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The complainant was concerned that pay stubs were not distributed in sealed envelopes. 


In our draft report, we stated that under the Ministry’s "Payroll Procedures", pay cheques/pay 
stubs were being distributed to staff through supervisors or delegates. Staff not on duty on pay 
day could pick up their cheques at the Business Office. The Ministry stated that only 4 out of 
750 staff had requested that their pay stubs be placed in a sealed envelope. 


While we accepted that it was a duty of supervisors or delegates to distribute pay cheques/pay 
stubs to employees, it was our view that they needed to know only the names of the employees 
in order to perform this duty. The disclosure of any other personal information about employees 
to supervisors or delegates in the distribution of pay cheques/pay stubs was not in accordance 
with section 42(d) of the Act. 


We also examined the other provisions of section 42 of the Act and determined that none were 
applicable in the circumstances of this case. 


Conclusion: The disclosure of personal information other than the names of employees 
to supervisors or delegates who distributed employees’ pay cheques/pay 
stubs was not in accordance with section 42 of the Act. 


In its submissions to our draft report, the Ministry advised that in October 1993, new payroll 
procedures were initiated that provided for greater protection of personal information. The new 
payroll procedures required all staff to pick up their own pay cheque/pay stub personally from 
the Business Office. It was the Ministry’s view that the new procedures eliminated the need to 
seal pay cheques/pay stubs in envelopes. 


Computer Printouts of Time Sheets 


The Ministry stated that it was its view that disclosure of employees’ SINs on computer printouts 
to certain staff was in accordance with both sections 42(c) and 42(d) of the Act. 


As previously indicated, section 42(d) permits the disclosure of personal information where the 
disclosure is made to an officer or employee of the institution who needs the record in the 
performance of his or her duties and where disclosure is necessary and proper in the discharge 
of the institution’s functions. 


The Ministry stated that SINs were needed to key data into the computer for payroll entry. The 
Payroll Department sent computer printouts of time sheets, which included employees’ SINs, 
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to Head Nurses, Supervisors, Department Heads and other managers for their input of the 
number of hours their assigned staff had worked. The completed time sheets were then returned 
to the Payroll department for processing. The Payroll department needed the SINs as the SIN 
was used as a unique employee identifier for entering data into the government payroll system. 
The Payroll Department had no way of keying in employees’ worked time data into the payroll 
system without this unique identifier. It was the Ministry’s view that if SINs were not included 
on the timesheet printouts before they were sent to staff of other departments, the payroll staff 
would not be able to enter the time worked information into the computer, when the time sheets 
were returned to them. 


It is our view that the administration of employees’ pay, specifically data entry of salary 
information is a function of the Ministry and that the disclosure of employees’ SINs was 
necessary to the payroll staff in order for them to be able to key into the government payroll 
system. Therefore, the disclosure of the employees’ SINs to the Payroll Department staff was 
in accordance with section 42(d) of the Act. However, it is our view that the disclosure of the 
SINs to staff of other departments, i.e. Head Nurses, Supervisors, Department Heads and other 
Managers was not necessary for them to be able to complete employees’ time sheets. Therefore, 
the disclosure of employees’ SINs to the staff in other departments was not in accordance with 
section 42(d) of the Act. 


We also examined the application of section 42(c) of the Act to the disclosure of employees’ 
SINs. This section states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


The employees’ SINs were collected as a unique identifier by the Payroll Department staff so 
that they could enter employees’ time worked data into the government payroll system. In our 
view, the disclosure to staff in other departments of employees’ SINs on computer printouts of 
time sheets sent to them, could not be said to be for this same purpose or for a consistent 
purpose. The disclosure to them was, therefore, not in accordance with section 42(c) of the Act. 


We have examined the other provisions of section 42 and have determined that none were 
applicable to the disclosure of employees’ SINs to staff who were not in the Payroll Department. 


Conclusions: The disclosure of employees’ SINs on computer printouts of time sheets 
to staff in the Payroll Department was in accordance with section 42 of 
the Act. 


The disclosure of employees’ SINs on computer printouts of time sheets 
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to staff in other departments was not in accordance with section 42 of the 
Act. 


Issue C: Were reasonable measures in place to prevent unauthorized access to "personal 
information" in accordance with Regulation 460 under the Act, as amended by 
Regulation 532/93? 


Section 4(1) of Regulation 460 under the Act, as amended by Regulation 532/93 states: 


Every head shall ensure that reasonable measures to prevent unauthorized access 
to the records in his or her institution are defined, documented and put in place, 
taking into account the nature of the records to be protected. 


Computer Printouts of Time Sheets 


The complainant was concerned that computer printouts of time sheets showing employees’ SINs 
were being sent to departments in an unsecured manner. He stated that time sheets were left 
open on the responsible individuals’ desks and could be read by anyone. 


The Ministry stated that computer printouts of time sheets from the Payroll Department were 
distributed to and returned from other departments in sealed envelopes. The Ministry further 
stated that according to its procedures, individuals responsible for completing the information 
on time sheets should not have had time sheets open on their desks in a way which allowed 
others to read them. However, the Ministry acknowledged that there may have been isolated 
incidents where there may have been non-compliance with these procedures. 


It is our view that there were reasonable measures documented and defined for the protection 
of personal information contained in computer printouts of time sheets when they were 
distributed to departments heads; when they were in the possession of department heads; and 
when they were returned to the Payroll Department. However, individual staff may not have 
been following the appropriate security procedures at all times. 


Conclusion: Reasonable measures to protect computer printouts of time sheets in the 
departments were defined, documented and in place, in accordance with 
section 4(1) of Regulation 460 under the Act, as amended by Regulation 
So2iooe 


Employee related information 
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The complainant was concerned that the Ministry was storing employee related injured worker 
information with regular patient information on a computer system that was accessible by other 
employees, who did not need this information. 


The complainant also stated that another employee had sought counselling and assistance from 
doctors at the hospital and that this employee’s personal information had then been stored in the 
regular patient computer system and was, thus, accessible by other employees who did not need 
access to employee-related information. The complainant, however, was unable to provide any 
documentation to support his contention about this incident. 


The Ministry stated that the computer used to track employee incidents including WCB claims, 
was a stand alone personal computer that was located in the office of the Co-ordinator of 
Occupational Health and Safety, and was distinct from the hospital’s computer system that 
contained regular patient information. This personal computer was not networked with any other 
computer system in the hospital. Further, the software in use had a password to prevent 
unauthorized personnel from accessing the information stored on the computer. 


The Ministry indicated that only the Co-ordinator of Occupational Health and Safety, who was 
responsible for workers’ compensation claims management, had access to the information on the 
computer. Any requests for information had to be first approved by the employee and then the 
administration of the hospital before it could be released. 


The Ministry stated that it was aware of the incident described by the complainant but that it had 
subsequently taken certain corrective measures. The new procedures were as follows. 


Employees who obtained professional help from the hospital were treated as regular patients but, 
their medical case book and all related documents were kept in locked cabinets under the custody 
and control of the Director of Clinical Records Services. The computerised medical records of 
these employees were continued to be kept in the hospital’s regular patient computer system. 
However, in the computerized records, the employee’s name was changed to an alias, and other 
identifying information such as address, next of kin, SIN and Health Card Number was recorded 
as "unknown". The key to the alias name in the computer was kept in the log in the confidential 
drawer by the Director of Clinical Records Services. 


The Ministry stated that these procedures were documented in the Clinical Records Departmental 
manual. 


Based on the above information, it is our view that reasonable measures were defined, 
documented and in place to prevent unauthorized access to the personal information of 
employees with respect to employee incidents including injured worker information. Similarly, 
measures were in place with respect to personal information, relating to those employees who 
had obtained professional help, which was stored in the hospital’s regular patient computer 
system. 
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Conclusion: Reasonable measures were defined, documented and in place to prevent 
unauthorized access to employee-related personal information stored in the 
hospital’s computer systems in accordance with section 4(1) of Regulation 
460 under the Act, as amended by Regulation 532/93. 


SUMMARY OF CONCLUSIONS 


oO 


The information in question was "personal information" as defined in section 2(1) of the 
Act. 


The disclosure of personal information other than the names of employees to supervisors 
or delegates who distributed employees’ pay cheques/pay stubs was not in accordance 
with section 42 of the Act. 


The disclosure of employees’ SINs on computer printouts of time sheets to staff in the 
Payroll Department was in accordance with section 42 of the Act. 


The disclosure of employees’ SINs on computer printouts of time sheets to staff in other 
departments was not in accordance with section 42 of the Act. 


Reasonable measures to protect computer printouts of time sheets in the departments 
were defined, documented and in place, in accordance with section 4(1) of Regulation 
460 under the Act, as amended by Regulation 532/93. 


Reasonable measures were defined, documented and in place, to prevent unauthorized 
access to employee-related personal information stored in the hospital’s computer systems 
in accordance with section 4(1) of Regulation 460 under the Act, as amended by 
Regulation 532/93. 


RECOMMENDATIONS 


We acknowledge that the Ministry has amended its payroll procedures effective October 1993. 
All staff are now required to pick up their own pay cheques/pay stubs personally from the 
Business Office. It is the Ministry’s view that this procedure has eliminated the need to seal pay 
cheques/pay stubs in sealed envelopes. We concur with this view. 


We, therefore, recommend that the Ministry: 


i 


find an alternative method for collecting employees’ time worked information that would 
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not involve the disclosure of employees’ SINs to staff of departments other than the 
Payroll Department. 


Ze remind staff of their obligation to follow Ministry procedures at all times with respect 
to the security of personal information contained in computer printouts of time sheets. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: December 8, 1993 
Susan Anthistle Date 


Compliance Review Officer 


[IPC Investigation 193-046P/December 8, 1993] 


Information and Privacy Governmen 
Commissioner/Ontario Pubkcations 
Commissaire a l'information 

et a la protection de la vie privée/Ontario 


p 


2 . 
mm me t 
\? OA! 
haron aw Fel 


INVESTIGATION REPORT 
INVESTIGATION 193-047P 


MINISTRY OF THE SOLICITOR GENERAL 
AND 
CORRECTIONAL SERVICES 


80 Bloor Street West, 80, rue Bloor ouest 416-326-3333 
a Suite 1700, Bureau 1700 1-800-387-0073 
Toronto, Ontario Toronto (Ontario) Fax/Téléc: 416-325-9195 


“YS ~=—soM5S 2V1 M5S 2V1 


Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontano, 5th Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toll free in 
Ontano. 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de l'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, rue Bay, Toronto (Ontario) 
M7A 1.N8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d’interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésoner de l'Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the Solicitor 
General and Correctional Services (the Ministry). 


Specifically, the complainant was concerned about attendance review letters regarding sick time 
that had been sent to bargaining unit staff at one of the Ministry’s correctional facilities. These 
letters were part of the process of the reviewing, monitoring and controlling of the attendance 
of all employees within the facility. Employees whose rate of absenteeism was becoming 
unacceptable were the subject of these letters. 

The complainant was concerned, however, that the Ministry had not at any time notified the 
individuals involved, including himself, that the personal information contained in these 
attendance review letters had been collected. He was also concerned that the attendance review 
letters had subsequently been summarized in a list which was then posted on a notice board. 
The complainant believed that these actions were in contravention of the Freedom of Information 
and Protection of Privacy Act (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was notice of the collection of the personal information contained in the 
attendance letters given in accordance with section 39(2) of the Act? 


(C) | Was the personal information in the summary list disclosed in accordance with 
section 42 of the Act? 
RESULTS OF THE INVESTIGATION 
Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 
Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
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(h) the individual’s name if it appears with other personal information relating 
to the individual... 


Attendance review letters and the summary list contained names of individuals together with 
information about their absences due to sickness. It is our view that this information satisfied 
paragraph (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in section 2(1) 
of the Act. 


Issue B: Was notice of the collection of personal information contained in attendance 
review letters given in accordance with section 39(2) of the Act? 


Section 39(2) of the Act states: 


Where personal information is collected on behalf of an institution, the head shall, 
unless notice is waived by the responsible minister, inform the individual to 
whom the information relates of, 


(a) the legal authority for the collection; 


(b) — the principal purpose or purposes for which the personal information is 
intended to be used; and 


(c) the title, business address and business telephone number of a public 
official who can answer the individual’s questions about the collection. 


The Ministry acknowledged that notice of the collection of attendance information which was 
later included in the attendance letters was not given to staff who were hired before the Act was 
in effect. This included the complainant. 


However, in response to our draft report, the Ministry submitted that in its view, sufficient 
notice was given to the complainant, since information about the collection appears in the 1993 - 
1994 Directory of Records. This publication contains a list of particular records held by each 
institution under the Act in addition to the list of common records found in most institutions. 


The Ministry stated that the Directory of Records contains a discussion of the "General 
Attendance Recording System(CARS)". This discussion includes "the location, legal authority, 
type of information collected, the principle uses and the user (who would be the contact person) 
as well as the telephone number and address of the Freedom of Information Co-ordinator." 
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The Ministry submitted that the intent of the Directory of Records is to give notice to the public, 
as well as employees, of the type of information collected ‘and maintained by an institution. It 
stated that since the Directory is a public record and is available in the Ministry’s correctional 
facility, this forms due and sufficient notice of its collection of attendance information to 
employees and meets the requirements of section 39(2) of the Act. 


Section 39(2) states in part that "[w]Jhere personal information is collected on behalf of an 
institution, the head shall, unless notice is waived by the responsible minister, inform the 
individual..... " (emphasis added). 


It is our view that including the information in the Directory of Records is not sufficient notice 
of the Ministry’s collection. Such an approach would require that individuals regularly check 
the Directory of Records to determine what information is being collected rather than being 
informed of the collection by the Ministry. This approach is not consistent with the purposes 
of section 39(2) which is intended to make individuals aware of information which is being 
collected and the purpose(s) for the collection. It is our view, therefore, that the Ministry did 
not give notice of its collection of personal information to employees hired before the 
implementation of the Act. 


Conclusion: Notice of the collection of personal information contained in the attendance letters 
was not given in accordance with section 39(2) of the Act to employees who had 
been hired prior to the implementation of the Act. 


Issue C: Was the personal information in the summary list disclosed in accordance 
with section 42 of the Act? 


Under the Act, personal information in the custody or control of an institution may be disclosed 
only in the specific circumstances outlined in section 42. 


In this case, the Assistant Superintendent of the facility had prepared a list of employees who 
were establishing a pattern of unacceptable attendance. This list was fastened to a clip board 
and given to the Unit Supervisor for his information and reference in the event that the listed 
employees failed to report for duty as assigned. 


The Ministry acknowledged that the list was then inappropriately eomae in a rather public area 
where several employees had access to the information. 


We have examined the provisions of section 42 of the Act and have found that none were 
applicable to this disclosure of the personal information in the summary list. 


We note, however, that upon receipt of a verbal complaint from the complainant, the Assistant 


Superintendent ordered the list removed and placed in a confidential envelope for the restricted 
use of the Supervisor. The Assistant Superintendent also apologized verbally to the complainant. 


[IPC Investigation 193-047P/October 27, 1993] 


Bh. 


Conclusion: The disclosure of personal information in the summary list was not in accordance 


with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


fe) The information in question was "personal information" as defined in section 2(1) of the 
Act. 

O Notice of the collection of personal information contained in the attendance letters was 
not given in accordance with section 39(2) of the Act to employees who had been hired 
prior to the implementation of the Act. 

O The disclosure of personal information in the summary list was not in accordance with 
the Act. 

RECOMMENDATIONS 


We recommend that: 


(1) 


(2) 


the Ministry provide notice of the collection of attendance information also to those 
employees hired before the implementation of the Act in accordance with section 39(2) 
of the Act. 


the Ministry include information about the requirements of the Act for the disclosure of 
personal information in any policy or guidelines on the reviewing, monitoring and 
controlling of employees’ attendance. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 


recommendations. 
Oniginal signed by: October 27, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Workers’ Compensation 
Board (the Board). 


The complainant stated that the Board had collected and disclosed information concerning her 
sexual life to her employer, in contravention of the Freedom of Information and Protection of 
Privacy Act (the Act). 


The information was contained in a psychiatrist’s Non Economic Loss Assessment and cover 
letter to the Board (the NEL), relating to the complainant’s claim for Chronic Pain Disability. 
The NEL contained information concerning the complainant’s medical condition and her sexual 
life with her spouse. 


The complainant advised she was employed by a small company, situated in the same small town 
in which she resided. Based on comments she and other family members had received, the 
complainant believed her employer had disclosed details in the NEL to residents of the town. 
The Workers’ Compensation Act has established a two-track benefit system for workers who 
suffer permanent consequences because of their workplace injuries. It provides compensation 
for the permanent impairment (the non-economic loss award for the loss of enjoyment of 
everyday life) and the future loss of earnings (the economic loss award for the employment 
impact) which result from the injury. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information contained in the NEL "personal information" as defined in 
section 2(1) of the Act? If yes, 


(B) Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


(C) Was the personal information disclosed in accordance with section 42 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information contained in the NEL "personal information" as defined 
in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 
(h) the individual’s name where it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other personal 


information about the individual; 


We reviewed a copy of the NEL. It contained the complainant’s name together with information 
about the complainant’s medical condition and her sexual life with her spouse. 


It is our view that the information contained in the NEL met the requirements of paragraph (h) 
of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information contained in the NEL was personal information as 
defined in section 2(1) of the Act. 


Issue B: Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Board stated that to properly make a NEL assessment, and to fairly determine the amount 
of compensation due to the complainant, collection of the information concerning sexual life was 


necessary to the proper administration of a lawfully authorized activity. 


The Board referred us to section 42 of the Workers’ Compensation Act (the WCA), which 
addresses NEL assessments. Sections 42(1) and (5), in particular, state: 


(1) A worker who suffers permanent impairment as a result of an injury is 
entitled to receive compensation for non-economic loss in addition to any other 
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benefit receivable under this Act. 


(5) The Board shall determine in accordance with the prescribed rating 
schedule and having regard to medical assessments conducted under this section 
the degree of a worker’s permanent impairment expressed as a percentage of total 
permanent impairment. 


Based on the above provisions of the WCA, it is our view that conducting a NEL medical 
assessment to determine the compensation due to a worker who has suffered permanent 
impairment as a result of an injury, is a lawfully authorized activity. 


With regard to whether the collection of information concerning a worker’s sexual life is 
"necessary" to conducting NEL assessments, the Board advised us of the following. 


The Board stated that when considering the amount of compensation for a NEL award, it is 
important that a psychiatrist fully assess four areas of functioning, in determining the severity 
of impairment for the purposes of determining an award in cases of Chronic Pain Disability. 


The Board has adopted the American Medical Association (AMA) Guides to the Evaluation of 
Permanent Impairment. These areas are: 


1) Activities of Daily Living 

2) Social Functioning 

3) Concentration, persistence and pace 

4) Ability to adapt to stress circumstances. 


The Board explained that the more comprehensive the examination of these areas, the more 
accurate the evaluation of the extent of the impairment. Under Activities of Daily Living, the 
AMA Guides specify this to include activities such as "self care and personal hygiene, 
communication, ambulation, attaining all normal living posture, travel, non specialized hand 
activities, sexual function, social and recreational activities". The Guides also state that "what 
is assessed is not simply the number of activities that are restricted but the overall degree of 
restrictions or combination of restrictions". It is in this context that questions are asked by the 
physician about a worker’s sexual life. It is an aspect of functioning that can be impaired by 
a worker’s injury. If it is impaired, then the worker’s award should reflect that impairment in 
the context of his/her functioning in this and all the other areas examined. 


The Board stressed that it is important to understand that this is an extensive evaluation of the 
impact of the worker’s pain on his or her everyday life, and not just his/her work. This allows 
for compensation for changes from pre-accident levels of functioning. While sexual function 
may be a more sensitive area that is being assessed, it is no less important than the many other 
areas being examined to arrive at an award. In short, questions of a sexual nature are necessary 
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to conduct a thorough assessment. 


Based on the above, it is our view that the Board had the authority to collect the information 
concerning the complainant’s sexual life, as it was necessary to the proper administration of a 
lawfully authorized activity, that being, the conduct of a NEL medical assessment to determine 
appropriate compensation. Thus, the Board collected the complainant’s personal information in 
accordance with section 38(2) of the Act. 


Conclusion: The Board had the authority to collect the information, in accordance with 
section 38(2) of the Act. 


Issue C: Was the personal information disclosed in accordance with section 42 of the 
Act? 


The complaint concerns disclosure to the complainant’s employer. Under the Act, personal 
information in the custody or control of an institution cannot be disclosed except in the specific 
circumstances outlined in section 42. 


Section 42(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act 
of Parliament or a treaty, agreement or arrangement thereunder; 
(emphasis added) 


The Board cited section 42(12) of the WCA as its legislative authority for the disclosure, in 
accordance with section 42(e) of the Act. 


Section 42(12) of the WCA requires the Board to send a copy of the NEL to the accident 
employer. It states: 


(12) The Board shall send a copy of the medical assessment conducted under 
subsection (9) to the worker and to the employer who employed the worker on 
the date of the injury. 


In our view, the Board’s disclosure of the complainant’s personal information to the employer 


was in accordance with section 42(e) of the Act, for the purpose of complying with an Act of 
the Legislature. 
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Conclusion: The Board’s disclosure of the NEL to the employer was in accordance 
with section 42 of the Act. 


Other Matters 


During the course of this investigation, the following matter was identified which should be 
brought to the Board’s attention. 


Mailing Procedures for NELs 


We asked the Board about the manner in which NELs are sent to employers. We were advised 
that employers’ mailing addresses are identified on the computer system. If an employer has 
designated a named individual for its correspondence on a claim, the Adjudicator will update the 
system to state attention to this individual and the NEL would be sent, addressed accordingly. 
Accompanying the NEL is a cover letter reminding the employer of its obligation under the 
WCA to not disclose the information. Confidential envelopes are not used. 


We are concerned that the Board does not use confidential envelopes when mailing NELs to 
employers, and that where an appropriate official has not been identified, sensitive medical 


information may be viewed unnecessarily by the employer’s staff, eg. individuals responsible 
for opening and delivering the employer’s mail. 


SUMMARY OF CONCLUSIONS 


e The information contained in the NEL was personal information as defined in section 
2(1) of the Act. 


e The Board had the authority to collect the personal information, in accordance with 
section 38(2) of the Act. 


@ The Board’s disclosure of the NEL to the employer was in accordance with section 42 
of the Act. 
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RECOMMENDATION 


We recommend that the Board use confidential envelopes when mailing out medical information 
to employers. The envelopes should be addressed to a named officer, where this indiviudal has 
been identified by the employer. If an officer has not been designated, a generic title should be 
used, for example, "WCB Claims Administrator". 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: November 26, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Workers’ Compensation 
Board (the Board). 


The complainant stated that the Board had collected and disclosed information concerning her 
sexual life to her employer, in contravention of the Freedom of Information and Protection of 
Privacy Act (the Act). 


The information was contained in a psychiatrist's Non Economic Loss Assessment and cover 
letter to the Board (the NEL), relating to the complainant’s claim for Chronic Pain Disability. 
The NEL contained information concerning the complainant’s medical condition and her sexual 
life with her spouse. 


The complainant advised she was employed by a small company, situated in the same small town 
in which she resided. Based on comments she and other family members had received, the 
complainant believed her employer had disclosed details in the NEL to residents of the town. 
The Workers’ Compensation Act has established a two-track benefit system for workers who 
suffer permanent consequences because of their workplace injuries. It provides compensation 
for the permanent impairment (the non-economic loss award for the loss of enjoyment of 
everyday life) and the future loss of earnings (the economic loss award for the employment 
impact) which result from the injury. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information contained in the NEL "personal information" as defined in 
section 2(1) of the Act? If yes, 


(B) Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


(C) Was the personal information disclosed in accordance with section 42 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information contained in the NEL "personal information" as defined 
in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 
(h) — the individual’s name where it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other personal 


information about the individual; 


We reviewed a copy of the NEL. It contained the complainant’s name together with information 
about the complainant’s medical condition and her sexual life with her spouse. 


It is our view that the information contained in the NEL met the requirements of paragraph (h) 
of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information contained in the NEL was personal information as 
defined in section 2(1) of the Act. ( 


Issue B: Did the Board have the authority to collect the personal information, in 
accordance with section 38(2) of the Act? 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Board stated that to properly make a NEL assessment, and to fairly determine the amount 
of compensation due to the complainant, collection of the information concerning sexual life was 


necessary to the proper administration of a lawfully authorized activity. 


The Board referred us to section 42 of the Workers’ Compensation Act (the WCA), which 
addresses NEL assessments. Sections 42(1) and (5), in particular, state: 


(1) A worker who suffers permanent impairment as a result of an injury is 
entitled to receive compensation for non-economic loss in addition to any other 


[IPC Investigation 193-048P/November 26, 1993] 


benefit receivable under this Act. 


(5) The Board shall determine in accordance with the prescribed rating 
schedule and having regard to medical assessments conducted under this section 
the degree of a worker’s permanent impairment expressed as a percentage of total 
permanent impairment. 


Based on the above provisions of the WCA, it is our view that conducting a NEL medical 
assessment to determine the compensation due to a worker who has suffered permanent 
impairment as a result of an injury, is a lawfully authorized activity. 


With regard to whether the collection of information concerning a worker’s sexual life is 
"necessary" to conducting NEL assessments, the Board advised us of the following. 


The Board stated that when considering the amount of compensation for a NEL award, it is 
important that a psychiatrist fully assess four areas of functioning, in determining the severity 
of impairment for the purposes of determining an award in cases of Chronic Pain Disability. 


The Board has adopted the American Medical Association (AMA) Guides to the Evaluation of 
Permanent Impairment. These areas are: 


1) Activities of Daily Living 

2) Social Functioning 

3) Concentration, persistence and pace 

4) Ability to adapt to stress circumstances. 


The Board explained that the more comprehensive the examination of these areas, the more 
accurate the evaluation of the extent of the impairment. Under Activities of Daily Living, the 
AMA Guides specify this to include activities such as "self care and personal hygiene, 
communication, ambulation, attaining all normal living posture, travel, non specialized hand 
activities, sexual function, social and recreational activities". The Guides also state that "what 
is assessed is not simply the number of activities that are restricted but the overall degree of 
restrictions or combination of restrictions". It is in this context that questions are asked by the 
physician about a worker’s sexual life. It is an aspect of functioning that can be impaired by 
a worker’s injury. If it is impaired, then the worker’s award should reflect that impairment in 
the context of his/her functioning in this and all the other areas examined. 


The Board stressed that it is important to understand that this is an extensive evaluation of the 
impact of the worker’s pain on his or her everyday life, and not just his/her work. This allows 
for compensation for changes from pre-accident levels of functioning. While sexual function 
may be a more sensitive area that is being assessed, it is no less important than the many other 
areas being examined to arrive at an award. In short, questions of a sexual nature are necessary 
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to conduct a thorough assessment. 


Based on the above, it is our view that the Board had the authority to collect the information 
concerning the complainant’s sexual life, as it was necessary to the proper administration of a 
lawfully authorized activity, that being, the conduct of a NEL medical assessment to determine 
appropriate compensation. Thus, the Board collected the complainant’s personal information in 
accordance with section 38(2) of the Act. 


Conclusion: The Board had the authority to collect the information, in accordance with 
section 38(2) of the Act. 


Issue C: Was the personal information disclosed in accordance with section 42 of the 
Act? 


The complaint concerns disclosure to the complainant’s employer. Under the Act, personal 
information in the custody or control of an institution cannot be disclosed except in the specific 
circumstances outlined in section 42. 


Section 42(e) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an Act 
of Parliament or a treaty, agreement or arrangement thereunder; 
(emphasis added) 


The Board cited section 42(12) of the WCA as its legislative authority for the disclosure, in 
accordance with section 42(e) of the Act. 


Section 42(12) of the WCA requires the Board to send a copy of the NEL to the accident 
employer. It states: 


(12) The Board shall send a copy of the medical assessment conducted under 
subsection (9) to the worker and to the employer who employed the worker on 
the date of the injury. 


In our view, the Board’s disclosure of the complainant’s personal information to the employer 


was in accordance with section 42(e) of the Act, for the purpose of complying with an Act of 
the Legislature. 


{IPC Investigation [93-048P/November 26, 1993] 


(ny 


Peace 


Conclusion: The Board’s disclosure of the NEL to the employer was in accordance 
with section 42 of the Act. 


Other Matters 


During the course of this investigation, the following matter was identified which should be 
brought to the Board’s attention. 


Mailing Procedures for NELs 


We asked the Board about the manner in which NELs are sent to employers. We were advised 
that employers’ mailing addresses are identified on the computer system. If an employer has 
designated a named individual for its correspondence on a claim, the Adjudicator will update the 
system to state attention to this individual and the NEL would be sent, addressed accordingly. 
Accompanying the NEL is a cover letter reminding the employer of its obligation under the 
WCA to not disclose the information. Confidential envelopes are not used. 


We are concerned that the Board does not use confidential envelopes when mailing NELs to 
employers, and that where an appropriate official has not been identified, sensitive medical 


information may be viewed unnecessarily by the employer’s staff, eg. individuals responsible 
for opening and delivering the employer’s mail. 


SUMMARY OF CONCLUSIONS 


e The information contained in the NEL was personal information as defined in section 
2(1) of the Act. 


e The Board had the authority to collect the personal information, in accordance with 
section 38(2) of the Act. 


e The Board’s disclosure of the NEL to the employer was in accordance with section 42 
of the Act. 
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RECOMMENDATION 


We recommend that the Board use confidential envelopes when mailing out medical information 
to employers. The envelopes should be addressed to a named officer, where this indiviudal has 
been identified by the employer. If an officer has not been designated, a generic title should be 
used, for example, "WCB Claims Administrator". 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: November 26, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning one of the Ministry of 
Health’s psychiatric hospitals (the Hospital). 


The complainant, an employee of the Hospital, had been required to provide a medical certificate 
to the Hospital after being absent from work for one day. The medical certificate was then 
disclosed to the MHospital’s Assistant Administrator, Patient Services (the Assistant 
Administrator); Regional Human Resources Administrator (the HR Administrator); and one of 
the Ministry’s legal counsels (the Legal Counsel). 


The complainant stated that the disclosure of her personal information in the medical certificate 
to these individuals was contrary to the Freedom of Information and Protection of Privacy Act 
(the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Were the disclosures of the personal information to the Assistant Administrator, 


the HR Administrator, and the Legal Counsel, in accordance with section 42 of 
the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) — the individual’s name where it appears with other personal information 


relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 
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The complainant provided a copy of the medical certificate in question. It contained the 
complainant’s name, the name and address of her physician, the date she had been absent from 
work, and the fact that she had been absent from work for a "medical reason". 


It is our view that the information contained in the medical certificate met the requirements in 
paragraph (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Were the disclosures of the personal information to the Assistant 
Administrator, the HR Administrator, and the Legal Counsel, in accordance 
with section 42 of the Act? 


In support of her complaint, the complainant provided a policy dated 91/10/31 from the 
Hospital’s Policy and Procedure Manual (the Policy). The subject of the Policy was 
"Confidentiality of Employee Health Records". The Purpose of the Policy was to safeguard the 
privacy of all employees of the Hospital, and to ensure that all individuals using Employee 
Health Services were protected from unauthorized or inappropriate disclosure of occupational 
health information. 


Point 3.3 of the Policy states: 


Information released to management shall be limited to the worker’s 
fitness/unfitness to work, or restrictions on the worker’s ability to perform all 
aspects of the job (Appendix 2). When an employee is absent from work due to 
injury or illness, the original copy of a doctor’s certificate should be submitted 
to Employee Health Services. The information regarding the probable date of 
return and the prognosis will be relayed to the supervisor or manager concerned 
on a need-to-know basis only. No diagnosis or details of treatment are to be 
disclosed to management. 


The complainant stated that she had provided the medical certificate to her supervisor, upon 
request by the Assistant Administrator. When it was received, it was reviewed by the Assistant 
Administrator and the HR Administrator and discussed with Legal Counsel. The complainant 
submitted that, based upon the Hospital’s Policy, the actual medical certificate should not have 
been disclosed by her supervisor to these individuals but should have gone directly to Employee 
Health Services where any relevant information would have been relayed to management on a 
need to know basis. 


Under the Act, personal information in the custody or control of an institution cannot be 
disclosed except in the specific circumstances outlined in section 42. 
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With regard to the disclosure of the personal information in the medical certificate, the Ministry 
has relied upon section 42(d) of the Act, stating that the medical certificate was disclosed to the 
Assistant Administrator, the HR Administrator, and the Legal Counsel for justifiable, 
organizational reasons. 


Section 42(d) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) where disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and where 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


In our view, verifying an employee’s absence from work by requesting an employee’s medical 
certificate is an administrative function of the Hospital. 


The Assistant Administrator is the Chief Nursing Officer responsible for the entire administrative 
operation of the Patient Services Department. The HR Administrator is responsible for assisting 
the Assistant Administrator in ensuring that policies and procedures are interpreted correctly and 
uniformly across the Department and Hospital. In the circumstances of this case, the Assistant 
Administrator and the HR Administrator were involved in a legal matter between a group of 
employees, including the complainant, and the Hospital. The legal matter arose from an order 
made under the Occupational Health and Safety Act regarding minimum staffing requirements 
at the Hospital. The matter was dealt with at a hearing by the Ministry of Labour. 


The Assistant Administrator and the HR Administrator thought that there may have been a 
potential overlap between the absence of the complainant from work and the cancellation of the 
second day of the hearing with the Ministry of Labour, which the complainant had been 
scheduled to attend. The Hospital asked for a medical certificate from the complainant in order 
to verify the reason for her absence from work. In our view, and in accordance with the Policy, 
the Assistant Administrator and the HR Administrator needed the complainant’s name and the 
date and reason she was absent from work, ie. "medical", in the performance of their duties of 
verifying the reason for the complainant’s absence. In our view, the description of "medical 
reason" on the medical certificate did not reveal information about the complainant’s diagnosis 
or details of treatment. 


In our view, the disclosure of the complainant’s name and the date and reason she was absent 
from work, to both the Assistant Administrator and the HR Administrator was a disclosure to 
officers who needed the information in the performance of their duties, and the disclosure was 
necessary and proper in the discharge of one of the Hospital’s functions. Therefore, the 
_ disclosure was in accordance with section 42(d) of the Act. 
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The Hospital stated that, like the Assistant Administrator and the HR Administrator, the Legal 
Counsel also needed the complainant’s name and the date and reason for her absence, in the 
performance of her duties, in accordance with section 42(d) of the Act. In our draft report, we 
stated that it was our view that in the circumstances of this case and at the time of the actual 
disclosure, the Legal Counsel’s duties were limited to representing the Hospital at the hearing 
held by the Ministry of Labour regarding the occupational health and safety matter. Verifying 
the reason for the complainant’s absence was a separate matter which was not the responsibility 
of the Legal Counsel and was not relevant to her responsibility of representing the Hospital in 
the legal matter. Given this, it was our view that the Legal Counsel did not need the 
complainant’s personal information in the performance of her duties. 


In its comments on our draft report, the Ministry stated that the Legal Counsel’s responsibility 
was not limited to representing the Ministry regarding the occupational health and safety matter. 
She was asked by the Hospital for her legal advice as to whether or not, under the terms of the 
Collective Agreement, the Hospital could or should request a medical certificate from the 
complainant. She was also consulted regarding the adequacy of the medical certificate provided 
by the complainant, and she was consulted on the basis that, should a grievance result, she 
would be acting as counsel on behalf of the Hospital at the grievance hearing. Consequently, 
the Legal Counsel’s role in this matter and the disclosure of the personal information to her was 
not solely on the basis that she had been representing the Hospital in the occupational health and 
safety matter. 


While the Legal Counsel was asked to provide advice for the reasons identified above, it is our 
view that at the time of the disclosure, the complainant’s personal information in the medical 
certificate was not needed by the Legal Counsel in the performance of her duties. It is our view 
that the Legal Counsel could have given her advice without the complainant’s identity being 
disclosed to her. 


Therefore, our view remains that the disclosure of the complainant’s name together with the date 
and reason for her absence to the Legal Counsel was not in accordance with section 42(d) of the 
Act. It is also our view that no other provisions in section 42 applied to this disclosure. 


The complainant’s medical certificate also included her personal physician’s name and address. 
Although the Hospital submitted that the Assistant Administrator, the HR Administrator, and the 
Legal Counsel needed this particular information in the performance of their duties, the 
Hospital’s Policy does not identify an employee’s physician’s name and address as information 
from a medical certificate about which management would need to know. It is our view that the 
Hospital, in drafting its Policy, would have given careful consideration to identifying the specific 
information that management would require from an employee’s medical certificate. Given this, 
and considering the relevance of this information to the legal matter the Hospital and 
complainant were involved in, it is our view that the Assistant Administrator, the HR 
Administrator, and Legal Counsel did not need the physician’s name and address in the 
performance of their duties. 
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Y. Therefore, in our view, the disclosure of the complainant’s physician’s name and address was 
not in accordance with section 42(d) of the Act. It is also our view that no other provisions in 
section 42 applied to this disclosure. 


Conclusion: The disclosure of the complainant’s name together with the date and 
reason for her absence, to the Assistant Administrator and the HR 
Administrator was in accordance with section 42 of the Act. The 
disclosure of the same information to the Legal Counsel was not. 


The disclosure of the complainant’s physician’s name and address was not 
in accordance with section 42 of the Act. 


Other Matters 


The Hospital informed us that it is involved in rewriting the Policy so that the Hospital’s 

"Occupational Health Services" will be the first recipient of a medical note or certificate. The 

Hospital stated that an employee’s supervisor will not receive a medical certificate from the 

employee. The certificate will be delivered directly to the Occupational Health Nurse. If the 

note is needed for administrative reasons, the personal medical information will be severed by 

‘ the Occupational Health Nurse. The revised draft policy clearly identifies the information that 
Cy may be relayed to management on a need to know basis. It also states that: 


All managers should be familiar with this policy. Managers should ensure that 


their staff are aware of the policy and should direct employees to submit medical 
certificates to Occupational Health Services. 


SUMMARY OF CONCLUSIONS 


% The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The disclosure of the complainant’s name together with the date and reason for her 


absence, to the Assistant Administrator and the HR Administrator was in accordance with 
section 42 of the Act. The disclosure of the same information to the Legal Counsel was 
not. 


e The disclosure of the complainant’s physician’s name and address was not in accordance 
with section 42 of the Act. 
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RECOMMENDATIONS 
We recommend that: 


1) the Ministry take steps to ensure that all Hospital Staff are aware of the limited purposes 
for which the disclosure of personal information is permitted under section 42 of the Act; 
and, ' 


2) the Ministry take steps to ensure that all Hospital Staff, including management, are aware 
of the circumstances under which personal information contained in an employee’s 
medical certificate may be released, further to the final revised Policy. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: December 16, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning one of the Ministry of 
Health’s psychiatric hospitals (the Hospital). 


The complainant, an employee of the Hospital, had been required to provide a medical certificate 
to the Hospital after being absent from work for one day. The medical certificate was then 
disclosed to the MHospital’s Assistant Administrator, Patient Services (the Assistant 
Administrator); Regional Human Resources Administrator (the HR Administrator); and one of 
the Ministry’s legal counsels (the Legal Counsel). 


The complainant stated that the disclosure of her personal information in the medical certificate 
to these individuals was contrary to the Freedom of Information and Protection of Privacy Act 
(the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Were the disclosures of the personal information to the Assistant Administrator, 


the HR Administrator, and the Legal Counsel, in accordance with section 42 of 
the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal information 


relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 
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The complainant provided a copy of the medical certificate in question. It contained the 
complainant’s name, the name and address of her physician, the date she had been absent from 
work, and the fact that she had been absent from work for a "medical reason”. 


It is our view that the information contained in the medical certificate met the requirements in 
paragraph (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Were the disclosures of the personal information to the Assistant 
Administrator, the HR Administrator, and the Legal Counsel, in accordance 
with section 42 of the Act? 


In support of her complaint, the complainant provided a policy dated 91/10/31 from the 
Hospital’s Policy and Procedure Manual (the Policy). The subject of the Policy was 
"Confidentiality of Employee Health Records". The Purpose of the Policy was to safeguard the 
privacy of all employees of the Hospital, and to ensure that all individuals using Employee 
Health Services were protected from unauthorized or inappropriate disclosure of occupational 
health information. 


Point 3.3 of the Policy states: 


Information released to management shall be limited to the worker’s 
fitness/unfitness to work, or restrictions on the worker’s ability to perform all 
aspects of the job (Appendix 2). When an employee is absent from work due to 
injury or illness, the original copy of a doctor’s certificate should be submitted 
to Employee Health Services. The information regarding the probable date of 
return and the prognosis will be relayed to the supervisor or manager concerned 
on a need-to-know basis only. No diagnosis or details of treatment are to be 
disclosed to management. 


The complainant stated that she had provided the medical certificate to her supervisor, upon 
request by the Assistant Administrator. When it was received, it was reviewed by the Assistant 
Administrator and the HR Administrator and discussed with Legal Counsel. The complainant 
submitted that, based upon the Hospital’s Policy, the actual medical certificate should not have 
been disclosed by her supervisor to these individuals but should have gone directly to Employee 
Health Services where any relevant information would have been relayed to management on a 
need to know basis. 


Under the Act, personal information in the custody or control of an institution cannot be 
disclosed except in the specific circumstances outlined in section 42. 
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With regard to the disclosure of the personal information in the medical certificate, the Ministry 
has relied upon section 42(d) of the Act, stating that the medical certificate was disclosed to the 


Assistant Administrator, the HR Administrator, and the Legal Counsel for justifiable, 
organizational reasons. 


Section 42(d) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) where disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and where 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


In our view, verifying an employee’s absence from work by requesting an employee’s medical 
certificate is an administrative function of the Hospital. 


The Assistant Administrator is the Chief Nursing Officer responsible for the entire administrative 
operation of the Patient Services Department. The HR Administrator is responsible for assisting 
the Assistant Administrator in ensuring that policies and procedures are interpreted correctly and 
uniformly across the Department and Hospital. In the circumstances of this case, the Assistant 
Administrator and the HR Administrator were involved in a legal matter between a group of 
employees, including the complainant, and the Hospital. The legal matter arose from an order 
made under the Occupational Health and Safety Act regarding minimum staffing requirements 
at the Hospital. The matter was dealt with at a hearing by the Ministry of Labour. 


The Assistant Administrator and the HR Administrator thought that there may have been a 
potential overlap between the absence of the complainant from work and the cancellation of the 
second day of the hearing with the Ministry of Labour, which the complainant had been 
scheduled to attend. The Hospital asked for a medical certificate from the complainant in order 
to verify the reason for her absence from work. In our view, and in accordance with the Policy, 
the Assistant Administrator and the HR Administrator needed the complainant’s name and the 
date and reason she was absent from work, ie. "medical", in the performance of their duties of 
verifying the reason for the complainant’s absence. In our view, the description of "medical 
reason" on the medical certificate did not reveal information about the complainant’s diagnosis 
or details of treatment. 


In our view, the disclosure of the complainant’s name and the date and reason she was absent 
from work, to both the Assistant Administrator and the HR Administrator was a disclosure to 
officers who needed the information in the performance of their duties, and the disclosure was 
necessary and proper in the discharge of one of the Hospital’s functions. Therefore, the 
disclosure was in accordance with section 42(d) of the Act. 
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The Hospital stated that, like the Assistant Administrator and the HR Administrator, the Legal 
Counsel also needed the complainant’s name and the date and reason for her absence, in the 
performance of her duties, in accordance with section 42(d) of the Act. In our draft report, we 
stated that it was our view that in the circumstances of this case and at the time of the actual 
disclosure, the Legal Counsel’s duties were limited to representing the Hospital at the hearing 
held by the Ministry of Labour regarding the occupational health and safety matter. Verifying 
the reason for the complainant’s absence was a separate matter which was not the responsibility 
of the Legal Counsel and was not relevant to her responsibility of representing the Hospital in 
the legal matter. Given this, it was our view that the Legal Counsel did not need the 
complainant’s personal information in the performance of her duties. 


In its comments on our draft report, the Ministry stated that the Legal Counsel’s responsibility 
was not limited to representing the Ministry regarding the occupational health and safety matter. 
She was asked by the Hospital for her legal advice as to whether or not, under the terms of the 
Collective Agreement, the Hospital could or should request a medical certificate from the 
complainant. She was also consulted regarding the adequacy of the medical certificate provided 
by the complainant, and she was consulted on the basis that, should a grievance result, she 
would be acting as counsel on behalf of the Hospital at the grievance hearing. Consequently, 
the Legal Counsel’s role in this matter and the disclosure of the personal information to her was 
not solely on the basis that she had been representing the Hospital in the occupational health and 
safety matter. 


While the Legal Counsel was asked to provide advice for the reasons identified above, it is our 
view that at the time of the disclosure, the complainant’s personal information in the medical 
certificate was not needed by the Legal Counsel in the performance of her duties. It is our view 
that the Legal Counsel could have given her advice without the complainant’s identity being 
disclosed to her. 


Therefore, our view remains that the disclosure of the complainant’s name together with the date 
and reason for her absence to the Legal Counsel was not in accordance with section 42(d) of the 
Act. It is also our view that no other provisions in section 42 applied to this disclosure. 


The complainant’s medical certificate also included her personal physician’s name and address. 
Although the Hospital submitted that the Assistant Administrator, the HR Administrator, and the 
Legal Counsel needed this particular information in the performance of their duties, the 
Hospital’s Policy does not identify an employee’s physician’s name and address as information 
from a medical certificate about which management would need to know. It is our view that the 
Hospital, in drafting its Policy, would have given careful consideration to identifying the specific 
information that management would require from an employee’s medical certificate. Given this, 
and considering the relevance of this information to the legal matter the Hospital and 
complainant were involved in, it is our view that the Assistant Administrator, the HR 
Administrator, and Legal Counsel did not need the physician’s name and address in the 
performance of their duties. 
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Therefore, in our view, the disclosure of the complainant’s physician’s name and address was 
not in accordance with section 42(d) of the Act. It is also our view that no other provisions in 
section 42 applied to this disclosure. 


Conclusion: The disclosure of the complainant’s name together with the date and 
reason for her absence, to the Assistant Administrator and the HR 
Administrator was in accordance with section 42 of the Act. The 
disclosure of the same information to the Legal Counsel was not. 


The disclosure of the complainant’s physician’s name and address was not 
in accordance with section 42 of the Act. 


Other Matters 


The Hospital informed us that it is involved in rewriting the Policy so that the Hospital’s 
"Occupational Health Services" will be the first recipient of a medical note or certificate. The 
Hospital stated that an employee’s supervisor will not receive a medical certificate from the 
employee. The certificate will be delivered directly to the Occupational Health Nurse. If the 
note is needed for administrative reasons, the personal medical information will be severed by 
the Occupational Health Nurse. The revised draft policy clearly identifies the information that 
may be relayed to management on a need to know basis. It also states that: 


All managers should be familiar with this policy. Managers should ensure that 


their staff are aware of the policy and should direct employees to submit medical 
certificates to Occupational Health Services. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The disclosure of the complainant’s name together with the date and reason for her 


absence, to the Assistant Administrator and the HR Administrator was in accordance with 
section 42 of the Act. The disclosure of the same information to the Legal Counsel was 
not. 


e The disclosure of the complainant’s physician’s name and address was not in accordance 
with section 42 of the Act. 
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We recommend that: 


1) 


2) 


the Ministry take steps to ensure that all Hospital Staff are aware of the limited purposes 
for which the disclosure of personal information is permitted under section 42 of the Act; 
and, 


the Ministry take steps to ensure that all Hospital Staff, including management, are aware 
of the circumstances under which personal information contained in an employee’s 
medical certificate may be released, further to the final revised Policy. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 


recommendations. 
Original signed by: December 16, 1993 
Susan Anthistle Date 


Compliance Review Officer 
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1) INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a separate school board (the 
Board). 


The complainant, a trustee for the Board, had informed a newspaper reporter of certain 
budgetary measures that the Board had been considering. The complainant became privy to this 
information during an in camera meeting of the Board. This information subsequently appeared 
in a newspaper article. 


Since the complainant had apparently not been at liberty to release this information, the Board 
subsequently reprimanded her for this "indiscretion". The reprimand occurred during one of 
the Board’s regular open meetings. While the members of the Board discussed the reprimand 
in camera, the Board made the following resolution in open session: 
That (the named complainant) be reprimanded for her lack of discretion 
concerning the comments made during a recent interview as published in the 
(named newspaper) ... 


i ) The above resolution was also recorded in the minutes of the Board’s meeting, which were 
available to the public. 


The complainant believed that the Board had disclosed her personal information during the open 
meeting, contrary to the Municipal Freedom of Information and Protection of Privacy Act (the 
Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did section 27 of the Act apply to this personal information? 


(C) Was the Board’s disclosure of the personal information, in accordance with 
section 32 of the Act? 


a RESULTS OF THE INVESTIGATION 
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Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an _ identifiable 
individual, including, 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; ("renseignements personnels") 


The Board stated that the information in question was not the complainant’s "personal 
information", since it concerned the complainant in her professional rather than her private 
capacity. 


In Order 170, Inquiry Officer John McCamus found that notes of proposed disciplinary action 
against an employee were considered to be the personal information of that employee. It is, 
thus, our view that similarly, in this case, the complainant’s name together with information 
about her reprimand was information which met the requirements of paragraph (h) of the 
definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Did section 27 of the Act apply to this personal information? 


Section 27 of the Act states that the privacy provisions of the Act do not apply to personal 
information that is maintained for the purpose of creating a record that is available to the general 
public. Specifically, section 27 states: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


It was the Board’s view that section 27 of the Act applied in the circumstances of this case. The 
Board stated that since the complainant had gone to the newspaper and made this issue public, 
any subsequent disclosure by the Board would not have contravened the Act since the 
information was already public. 


In our view, it cannot be said that the Board was maintaining the information concerning the 
complainant’s reprimand, for the purpose of making that information available to the general 
public. Thus, the Board may not rely on section 27 of the Act to exempt this information from 
the privacy provisions of the Act. 
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Conclusion: Section 27 of the Act did not apply to the personal information. 


Issue C: Was the Board’s disclosure of the personal information, in accordance with 
section 32 of the Act? 


Under the Act, an institution cannot disclose personal information in its custody or under its 


control except in the specific circumstances outlined in section 32 (see Appendix A for the full 
text). 


The Board advised that it had reprimanded the complainant in compliance with its policy entitled 
"Confidentiality of Information". The Board provided us with a copy of this policy, which 
stated, in part, that discussions during a Committee of the Whole meeting (i.e., an in camera 
meeting) are "absolutely confidential". The policy further stated that the Chairman, with the 
Board’s support, may reprimand a trustee for his or her indiscretion and lack of solidarity. 
Based on these policies, the Board stated that it had reprimanded the complainant in a public 
meeting because she had disclosed discussions of an in camera meeting to the newspaper 
reporter. 


The Board submitted that it had to follow these policies which were in place before the Act came 
into effect. The Act came into force in January 1991. Institutions covered by the Act are 
required to comply with the Act’s privacy provisions regarding the collection, use and disclosure 
of personal information. Thus, any disclosure by the Board of personal information in its 


custody or under its control must be in compliance with the disclosure provisions of section 32 
of the Act. 


We have examined section 32 and have found that none of the exceptions listed applied to the 
Board’s disclosure. It is, therefore, our view that the Board disclosed the complainant’s personal 


information at an open meeting contrary to section 32 of the Act. 


Conclusion: The Board’s disclosure of the personal information was not in accordance 
with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 


e Section 27 of the Act did not apply to the personal information. 


e The Board’s disclosure of the personal information was not in accordance with section 
32 of the Act. 
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RECOMMENDATIONS 


We recommend that the Board take steps to ensure that disclosures of personal information are 
in accordance with the Act, for example, by amending or clarifying its policies accordingly. 


Within six months of receiving this report, the Board should provide the Office of the 


Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: January 24, 1994 


Susan Anthistle Date 
Compliance Review Officer 
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APPENDIX A 


An institution shall not disclose personal information in its custody or under its control 
except, 


in accordance with Part I; 


if the person to whom the information relates has identified that information in particular 
and consented to its disclosure; 


for the purpose for which it was obtained or compiled or for a consistent purpose; 
if the disclosure is made to an officer or employee of the institution who needs the record 
in the performance of his or her duties and if the disclosure is necessary and proper in 


the discharge of the institution’s functions; 


for the purpose of complying with an Act of the Legislature or an Act of Parliament, an 
agreement or arrangement under such an Act or treaty; 


if disclosure is by a law enforcement institution, 


(i) to a law enforcement agency in a foreign country under an arrangement, a written 
agreement or treaty or legislative authority, or 


(ii) | to another law enforcement agency in Canada; 

if disclosure is to an institution or a law enforcement agency in Canada to aid an 
investigation undertaken with a view to a law enforcement proceeding or from which a 
law enforcement proceeding is likely to result; 

in compelling circumstances affecting the health or safety of an individual if upon 
disclosure notification is mailed to the last known address of the individual to whom the 


information relates; 


in compassionate circumstances, to facilitate contact with the next of kin or a friend of 
an individual who is injured, ill or deceased; 


to the Minister; 
to the Information and Privacy Commissioner; 


to the Government of Canada or the Government of Ontario in order to facilitate the 
auditing of shared cost programs. 


[IPC Investigation 193-053M/January 24, 1994] 


ROCOMMENDAT UE 
4 ive A 


Ye lnm rly bet rai EEE 


yt 0 gn orentaened Vit if bss Se 


Witcn ee tote of poet ty ae nowt. the Beart Mesh 


Lets ie | gts “Pryrwau hs oe ddr 
7 ] aA 2 : bg 7 - oh 
oy quiyiegigdie Bes boruteue tal st 


4 
st | The)! ATT id 


_ ieee ‘ 


ai an a 
boninilo aw Mt 

ay “> qi Teele ty A pete tral 
= ear 5 . «at we % yaigm 

A oo oahy ee : ee bes 

patter sett hm oy 8 suncizald i 

x) aaepome tant: QO ; pec sry 

, . cesar gra {iOS 2 - _ 
ose of ae canara? &° be ae 
as cava ies em pune Tee ai =e . : 


ne Te Cent oe 
5 iw qral ww i | 


i B igeibev 0d 6 eo Setons 
ca ate cain tach 


Information and Privacy 
Commissioner/Ontario 

Commissaire a l'information 

et a la protection de la vie privée/Ontario 


INVESTIGATION REPORT 


J INVESTIGATION 193-054P 


MINISTRY OF ENVIRONMENT AND ENERGY 


as 80 Bloor Street West, 80, rue Bloor ouest 416-326-3333 
ksi Suite 1700, Bureau 1700 1-800-387-0073 
Toronto, Ontario Toronto (Ontario) Fax/Téléc: 416-325-9195 

"Sey Ss M5 21 M5S 2V1 


Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontario, 5th Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toll free in 
Ontario 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de Il'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1N8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d'interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésorier de l'Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of 
Environment and Energy (the Ministry). 


The complainant was concerned that the Ministry had improperly disclosed his personal 
information in its publication "ENVIRONTARIO HIGHLIGHTS" and to the media, contrary 
to the provisions of the Freedom of Information and Protection of Privacy Act (the Act). In 
addition, the complainant was concerned that the personal information disclosed was inaccurate. 
Issues Arising from the investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Did section 37 of the Act apply to the personal information? 


(C) Was the disclosure of the personal information in accordance with section 42 of 
the Act? 


The issue regarding the complainant’s concern about the accuracy of the personal information 
disclosed has been addressed under the "Other Matters" section of this report. 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


The information disclosed in the published article contained the complainant’s name, the 
company where he had been employed, details of his conviction for offences under the 
Environmental Protection Act (the EPA), and the amount the complainant was said to have been 
fined. Similar information was contained in a press release. 


According to the Ministry, the charges against the complainant were laid as a direct result of his 


employment-related activities rather than his private activities. Thus, it was the Ministry’s 
position that the information disclosed was not the complainant’s personal information. 
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In Order P-434, Assistant Commissioner Mitchinson held that information is not automatically 
excluded from the scope of section 2(1), "simply because it was created in the employment 
context." 


The article and press release identified that it was the complainant who had been convicted and 
fined. Although the complainant had been charged as a result of his employment activities, it 
was he, personally, who had been convicted and ordered by the court to make restitution. 
Therefore, it is our view that the information in the article and press release was about an 
identifiable individual and thus, met the requirements of paragraph (h) of the definition of 
"personal information" in section 2(1) of the Act which states that: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) ~ the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


Conclusion: The information in question was personal information as defined in section 2(1) 
of the Act. 


Issue B: Did section 37 of the Act apply to the personal information? 


The Ministry stated that it enforces the EPA and has the authority to collect personal information 
as part of its investigations process into alleged violations. In this case, the Ministry had 
conducted an investigation into the activities of the employees of an incorporated company which 
had resulted in charges being laid against the complainant. The Ministry submitted that the 
charges against the complainant had been dealt with by the court, where information about the 
complainant’s activities had been placed on record and had thus, become available to the public. 


The Ministry stated that in this case, it was merely reflecting information that was already 
available to the public in order to serve as a deterrent to would-be-polluters. 


Section 37 of the Act states: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


It is our view that under section 37 of the Act, personal information maintained by an institution 
can be excluded from the application of Part I of the Act only if the personal information is 
maintained by that institution for the purpose of creating a record which is available to the 
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general public. In this particular case, it is our view that the Ministry could not be said to have 
been maintaining the complainant’s personal information specifically for the purpose of creating 
a record that was available to the general public. Therefore, section 37 of the Act did not apply 
and the privacy provisions of Part II were not excluded. 


Conclusion: Section 37 of the Act did not apply to the personal information at issue. 


Issue C: Was the disclosure of the personal information in accordance with section 42 
of the Act? 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 42. 


The Ministry submitted that the personal information was disclosed in accordance with section 
42(c) of the Act, which states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


Section 43 of the Act further provides that: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 41(b) and 41(c) only if the individual might reasonably 
have expected such a use or disclosure. 


Where personal information has been collected indirectly, a consistent purpose is one which is 
"reasonably compatible" with the purpose for which the information has been compiled. 


The Ministry stated that in enforcing the EPA, it has the role of informing the public of the 
ramifications of violations of the EPA so as to deter would-be-polluters. In this case, the 
Ministry publicized the complainant’s violations and the amount of his restitution in order to 
advise the public and would-be-polluters of the Ministry’s enforcement activities. The Ministry 
stated that by publicizing this information, the public was made aware of its efforts in a 
geographical area where concerned citizens and the media had shown particular attention to the 
issues. 
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In this case, the complainant’s personal information had originated from proceedings conducted 
in court. Except in the most exceptional circumstances, proceedings before the courts are open 
to the public. This serves the dual purpose of informing the public of judicial proceedings as 
well as acting as a deterrent to potential would-be-offenders. 


In our view, the Ministry subsequently disclosed the complainant’s personal information for 
substantially similar purposes: namely, to inform the public of its enforcement activities and to 
deter would-be-polluters. Accordingly, it is our view that the Ministry’s disclosure was for a 
purpose that was reasonably compatible with the purpose for which the personal information had 
originally been compiled by the court. Therefore, the disclosure was for a consistent purpose 
and was in accordance with section 42(c) of the Act. 


Conclusion: The disclosure of the personal information was in accordance with section 42 of 
the Act. 

Other Matters 

The complainant also stated that some of the personal information contained in the article and 

press release was inaccurate. The Ministry acknowledged that the information disclosed was not 

entirely accurate and has responded to the complainant’s request for correction under section 

47(2) of the Act. 


SUMMARY OF CONCLUSIONS 


The information in question was "personal information" as it is defined in section 2(1) 
of the Act. 


Section 37 of the Act did not apply to the personal information at issue. 


The disclosure of the personal information was in accordance with section 42 of the Act. 


Original signed by: January 26, 1994 
Ann Cavoukian, Ph.D Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Health (the 
Ministry). 


The complainant was concerned that the Ministry had disclosed her personal information to the 
Ontario Breast Screening Program (the OBSP) contrary to the provisions of the Freedom of 
Information and Protection of Privacy Act (the Act). 


The complainant had received a letter from the OBSP about a breast screening program. In this 
letter, the Director of the OBSP suggested that since the complainant was of "a certain age", she 
should be aware of certain facts about health risks. The Director also stated: "Your name was 
selected in a confidential manner using your Health Number and your age". 


The OBSP had asked the Ministry to perform a mailing to women between the ages of 50 and 
69, to make them aware of, and to invite them to, local breast screening clinics. The Ministry 
had set up a "confidentiality agreement" with Canada Post to perform the mailing from a listing 
that the Ministry had provided for four test sites. The listing provided to Canada Post consisted 
of the names and addresses of women who were between the ages of 50 and 69. 


The OBSP had provided the aforementioned form letter to Canada Post. This form letter did 
not contain any personal information when provided by the OBSP. Canada Post then conducted 
a "mail merge" of the information provided by the Ministry (i.e., the names and addresses from 
the listing were inserted onto the form letters provided by the OBSP). Canada Post subsequently 
sent a letter to each of the targeted individuals. 


At no time was personal information ever disclosed directly to the OBSP. The OBSP was not 
aware as to which individuals had received the letter unless the individual had chosen to contact 
one of the clinics. As well, the health number was never disclosed to either the OBSP or 
Canada Post. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) | Was the disclosure by the Ministry to Canada Post in accordance with section 42 
of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
age, sex, sexual orientation or marital or family status of the individual, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; (emphasis added) 


As already mentioned, the listing provided to Canada Post consisted of the names and addresses 
of women who were between the ages of 50 and 69. 


In our view, the information contained in this listing met the requirements in paragraphs (a), (d), 
and (h) of the definition of "personal information” in section 2(1) of the Act. 


Conclusion: The information in question was "personal information", as defined in 
section 2(1) of the Act. 
Issue B: Was the disclosure by the Ministry to Canada Post in accordance with section 


42 of the Act? 


Section 42 of the Act prohibits the disclosure of personal information by an institution, except 
in certain circumstances. Section 42(c), in particular, states: 


An institution shall not disclose personal information in its custody or under its 
control except, 
(c) for the purpose for which it was obtained or compiled or for a consistent 


purpose; (emphasis added) 
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Section 43 of the Act states: 


Where personal information has been collected directly from the individual to 
whom the information relates, the purpose of a use or disclosure of that 
information is a consistent purpose under clauses 41(b) and 42(c) only if the 
individual might reasonably have expected such a use or disclosure. 


The Ministry stated that it had collected the personal information in question on the Registered 
Persons Database for health planning and co-ordination purposes. This is substantiated by the 
notice of collection appearing on the Registration for Ontario Health Coverage form which states 
that: 


Collection of the information on this form is for the ... administration of the 
Health Insurance and the Ontario Drug Benefit Acts and for health planning and 
coordination. It is collected/used for these purposes under the authority of the 
Ministry of Health Act, section 6(1,2), Health Insurance Act, section 4(2)(b,f), 
10, 11(1) and Regulation 689/86 under the Ontario Drug Benefit Act, section 2. 


The Ministry further stated that the Minister of Health has the power to oversee and promote 
the health and physical well-being of the people of Ontario pursuant to section 6(2) of the 


Ministry of Health Act which states: 


It is the function of the Minister and he or she has power to carry out the 
following duties: 


Me To oversee and promote the health and the physical and mental well-being 
of the people of Ontario. 


Thus, one of the purposes for which the Ministry had obtained the personal information in 
question was for "health planning and co-ordination". It is our view that “health promotion" 
(from section 6(2) of the Ministry of Health Act) is compatible with health planning and co- 
ordination. In “promoting health", the Ministry disclosed the personal information to Canada 
Post so that the OBSP letter could be sent to targeted individuals. It is our view that these 
indiviuals could have reasonably expected such a disclosure of their personal information. 
Therefore, the Ministry’s disclosure of the personal information to Canada Post was for a 
consistent purpose, in accordance with section 42(c) of the Act. 


Conclusion: The disclosure of the personal information by the Ministry to Canada Post 
was in accordance with section 42 of the Act. 
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Other Matters 


During the course of this investigation, the following matter was identified which should be 
brought to the institution’s attention 


In the "Background of the Complaint", we indicated that the Ministry had set up a 
"confidentiality agreement" with Canada Post to perform the mailing. We reviewed this 
agreement and noted that it was signed only by the OBSP and Canada Post. The Ministry did 
not sign this agreement but sent a covering letter to Canada Post, stating that the agreement was 
"acceptable" to the Ministry. Since the Ministry has custody and control of this personal 
information, it is our view that the Ministry should also have signed the agreement. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information", as defined in section 2(1) of the 
Act. 
e The disclosure of the personal information by the Ministry to Canada Post was in 


accordance with section 42 of the Act. 


RECOMMENDATIONS 


We recommend that the Ministry sign such agreements since it has custody and control of the 
personal information in question. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: January 13, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Community Services 
Department of a Municipality (the Municipality). 


The complainant, a day care operator, wished to enter into a purchase of service agreement with 
the Municipality. He was required to provide certain information to the Municipality. The 
complainant was concerned that the collection of this information was contrary to Municipal 
Freedom of Information and Protection of Privacy Act (the Act). 


Collection 1: 

The complainant was required to fill out a "Budget Submission For Purchase of Service 
Agreement" package. The prescribed forms dictated that the complainant provide information 
relating to himself and to all staff members of his day care operation and their projected salaries. 
The complainant was concerned with the collection of this information. One of the forms in the 
package categorized staff by position. The complainant maintained that since he was the only 
person who was employed as a supervisor, he was clearly identifiable. 


Collection 2: 

The complainant wished to employ an individual at his day care centre who did not have the 
requisite qualifications under the Day Nurseries Act. Accordingly, the complainant made an 
application to the Ministry of Community and Social Services, for a provincial provisionally 
trained exemption under the Day Nurseries Act, on behalf of the individual. 


Day care operators involved in purchase of service agreements with the Municipality must, 
according to the Municipality’s Operating Criteria, submit an application for a municipal 
provisionally trained exemption as well. The Municipality required several supplementary 
documents to be filed with the application which would be taken into consideration in 
determining whether to approve the application. The complainant was concerned that the 
collection of some of the supplementary documentation was contrary to the Act. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Municipality’s collection of the personal information in accordance with 
section 28(2) of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an_ identifiable 
individual, including, 


(b) information relating to the education or the medical, psychiatric, 

. psychological, criminal or employment history of the individual or 

information relating to financial transactions in which the 
individual has been involved, 


(h) — the individual’s name if it appears with other personal information 
relating to the individual or where the disclosure of the name 
would reveal other personal information about the individual; 


Collection 1: 

The Budget Submission For Purchase of Service Agreement contained staff members’ names, 
positions held; actual annual salary paid to the position the previous year without a grant 
contribution; and the annual salary estimated for the position without a grant contribution, for 
the applicable year. 


In our view, this information met the requirements of paragraphs (b) and (h) of the definition 
of "personal information", in section 2(1) of the Act. 


Collection 2: 

The application for a provisionally trained exemption required the submission of the provincial 
approval letter, the advertisement of vacancy or receipts from advertisements, the individual’s 
diploma, a transcript of courses, a letter from an educational institution confirming outstanding 
courses and/or practicums, a letter of intent from a staff member, and A.E.C.E.O. Exam 
confirmation/results. . 


Of the required information, the complainant provided the provincial approval letter, the 
individual’s diploma, and a transcript of the individual’s courses. In our view, this information 
met the requirements of paragraphs (b) and (h) of the definition of "personal information", in 
section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


[IPC Investigation 193-079M/May 17, 1994] 


ys 


gf ee 


Issue B: Was the Municipality’s collection of the personal information in accordance 
with section 28(2) of the Act? 


Section 28(2) states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Municipality stated that, at its discretion, it may provide for the establishment of day 
nurseries. It may also enter into agreements with day care operators for nursery services, and 
may make expenditures as are necessary for those services. The Municipality indicated that 
these activities are authorized by section 3 of the Day Nurseries Act. 


Section 3 of the Day Nurseries Act states: 


(1) The council of a municipality may, subject to this Act and the regulations, by 
by-law provide for the establishment of day nurseries. 


(2) The council of a municipality may pass by-laws granting aid to day nurseries. 


(3) The council of a municipality may subject to this Act and the regulations, 
enter into an agreement with the operator of a day nursery for the furnishing of 
day nursery services for such children as is agreed upon, and the municipality 
may make expenditures as are necessary for the purpose. 


In our view, the Municipality’s establishment of day nurseries, the purchase of nursery services 


from day nursery operators and the making of expenditures necessary for this purpose, are 
lawfully authorized activities. 


The Municipality advised that in order to administer day nurseries and the purchase of service 
agreements, as well as determine the necessary expenditures for this purpose, an operating 
criteria was established. This criteria sets out municipal standards in accordance with the Day 
Nurseries Act and its regulations. 


Collection 1: 

The Municipality advised that it must determine the expenditures that are necessary for the 
purchase of services from day nursery operators who are a party to a purchase of service 
agreement. In order to do this, the day nursery operators must file a detailed budget submission. 


The budget submission package requires the day nursery operator to include the names of all day 
nursery staff, their positions held, and their projected salaries. 
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The Municipality stated that it has a responsibility to verify that any funds provided are used for 
the purposes intended. The Municipality stated that a significant percentage of the funding given 
in a purchase for service agreement is determined by salary expenditures. In accordance with 
the operating criteria, the total salaries for specified positions can not exceed salaries paid to the 
municipally operated day nurseries’ staff. To ensure the claimed costs have been incurred and 
the identified individuals have received the appropriate compensation, employee T4 slips are 
compared with the budget submission. 


The Municipality maintained that, therefore, the identities of all day nursery staff employed at 
the day care operation, the positions they held, and their projected salaries were needed to verify 
that the specified staff with the required qualifications or approvals held the positions and earned 
the projected salary as indicated in the budget submission. This would include the information 
about the complainant since he was the supervisor. 


In our view, the Municipality had a responsibility to verify the expenditures made for its 
purchase of day nursery services, and that the funds were used for the purposes intended. The 
Municipality was also required to verify that the specified staff with the necessary qualifications 
or approvals were functioning in the noted positions. In order to do so, it was necessary for the 
Municipality to know which specifically named individuals were projected to earn those salary 
dollars and what their qualifications were to hold those positions. The Municipality needed to 
verify that the identified individuals did in fact earn the projected salaries and that these salaries 
did not exceed salaries paid to the municipally operated day nurseries’ staff in the same 
positions. Therefore, it is our view that the Municipality’s collection of the personal information 
on the budget submission was necessary for the proper administration of lawfully authorized 
activities, namely, the purchase of nursery services and the determination of the expenditures 
necessary for this purpose. Therefore, the Municipality’s collection of the personal information 
was in accordance with section 28(2) of the Act. Given this finding, the complainant’s concern 
that he was identifiable by virtue of being the only supervisor need not be addressed. 


Collection 2: 

When an individual does not have the requisite qualifications under the Day Nurseries Act to be 
employed in a day nursery, an application may be brought under sections 59 and 60 of 
Regulation 262 of the Day Nurseries Act for a provisionally trained exemption. This application 
must be made by the day nursery operator, on behalf of the individual, because provisionally 
trained exemptions are "Site specific". A provisionally trained exemption allows an individual 
to function in a specific position where that individual has not fully completed their training. 


The Municipality stated that in order to properly administer day care facilities in accordance with 
the Day Nurseries Act and its regulations, it must be fully satisfied that employees working in 
a facility in which it is engaged in a purchase of service agreement have the required 
qualifications or approvals. The Municipality stated that when contracting with day care 
providers, it shares in the liability of the facility and thus, finds it necessary to verify that an 
individual qualifies to be provisionally trained according to the Municipality’s standards, as set 
out in its operating criteria. 
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The Municipality’s application for a provisionally trained exemption required the complainant 
to submit supplementary documentation, as stated under issue A. This documentation was to 
support the application. Of the required information, the complainant provided the individual’s 
provincial approval letter, diploma, and a transcript of courses. 


The Municipality stated that it needed this supporting personal information to assess whether the 
individual was qualified to hold the position despite not having the requisite qualifications under 
the Day Nurseries Act. 


In our view, the complainant’s submission of the supplementary documentation supporting the 
individual’s application for a provisionally trained exemption was necessary for the Municipality. 
to ensure that the individual was qualified to work in the day nursery operation with which the 
Municipality had a purchase of service agreement. The Municipality needed to be able to satisfy 
itself that the individual’s qualifications met its operating criteria since it ultimately shared in the 
liability of the facility. Therefore, in our view, the Municipality’s collection of this personal 
information was necessary to the proper administration of a lawfully authorized activity, that 
being, the provision of day care services under a purchase of service agreement. The 
Municipality’s collection of the personal information was, thus, in accordance with section 28(2) 
of the Act. 


Conclusion: The collection of the personal information on the budget submission was 
in accordance with section 28(2) of the Act. 


The collection of the personal information contained in the supplementary 
documentation for the provisionally trained exemption application was in 
accordance with section 28(2) of the Act. 


SUMMARY OF CONCLUSIONS 


° The information in question was personal information as defined in section 2(1) of the 
° The collection of the personal information on the budget submission was in accordance 


with section 28(2) of the Act. 


° The collection of the personal information contained in the supplementary documentation 
for the provisionally trained exemption application was in accordance with section 28(2) 
of the Act. 

Original signed by: May 17, 1994 

Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a College of Applied Arts 
and Technology (the College). 


The complainant had been a student in the College’s nursing program. In the College’s nursing 
division it was the practice of the professors to prepare anecdotal notes for each student. These 
anecdotal notes were reviewed by the students in weekly assessments with the professors, and 
were used in the preparation of the students’ final evaluations. The complainant requested 
access to her anecdotal notes and was informed by the College that these notes had been 
destroyed. 


The complainant was concerned that the College had prematurely destroyed the anecdotal notes, 
containing her personal information, contrary to the Freedom of Information and Protection of 
Privacy Act (the Act). She was also concerned about the security of the anecdotal notes, stating 
that the notes were kept in a binder readily accessible to all College students. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Were the anecdotal notes in the custody or under the control of the College? If 
yes, 


(C) Was the personal information retained by the College in accordance with section 
5(1) of Regulation 460 under the Act, as amended by Regulation 532/93? 


(D) Were reasonable measures in place to prevent unauthorized access to the personal 


information in accordance with section 4(1) of Regulation 460 under the Act, as 
amended by Regulation 532/93? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 
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(g) the views or opinions of another individual about the individual, and 


(h) the individual’s name where it appears with other personal information 
relating to the individual... 


The anecdotal notes consisted of written evaluations about the complainant made by the 
complainant’s professor. 


In our view, this information met the requirements in paragraphs (g) and (h) of the definition 
of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Were the anecdotal notes in the custody or under the control of the College? 


In this case, the complainant was informed by the College that the anecdotal notes she had 
requested had been destroyed. However, she was also informed that the anecdotal notes were 
the professors’ personal notes, prepared by the professors for their own use, and were, 
therefore, not in the custody or control of the College. 


Therefore, before we address the complainant’s concerns, we must determine whether the 
anecdotal notes were in the custody or under the control of the College, within the context of 
the Act. Accordingly, we have reviewed pages 10-12 of Order 120, where former 
Commissioner Sidney B. Linden made the following statement: 


In my view, it is not possible to establish a precise definition of the words 
"custody" or "control" as they are used in the Act, and then simply apply those 
definitions in each case. Rather, it is necessary to consider all aspects of the 
creation, maintenance and use of particular records, and to decide whether 
"custody" or "control" has been established in the circumstances of a particular 
fact situation. 


Commissioner Linden went on to provide the following non-exhaustive list of factors which can 
be of assistance in determining whether an institution has "custody" and/or "control" of records 
in particular situations: 


iF Was the record created by an officer or employee of the institution? 
jhe What use did the creator intend to make of the record? 
af Does the institution have possession of the record, either because it has 


been voluntarily provided by the creator or pursuant to a mandatory 
statutory or employment requirement? 
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4. If the institution does not have possession of the record, is it being held 
by an officer or employee of the institution for the purposes of his or her 
duties as an officer or employee? 


2). Does the institution have a right to possession of the record? 

6. Does the content of the record relate to the institution’s mandate and 
functions? 

I: Does the institution have the authority to regulate the record’s use? 

8. To what extent has the record been relied upon by the institution? 

9. How closely is the record integrated with other records held by the 
institution? 


10. Does the institution have the authority to dispose of the record? 


We have reviewed these factors while considering the College’s position. It is our view that the 
anecdotal notes were in the custody and under the control of the College. 


Anecdotal notes are written and retained by the professors to assist them in the preparation of 
the final written clinical evaluations for the students. The clinical evaluations reflect the success 
or failure of the student in the clinical nursing course. The College does, in fact, recognize 
clinical evaluations, created from the anecdotal notes, as College records, in the custody and 
under the control of the College. 


During the weekly assessment of the students, the professors refer to the anecdotal notes and 
allow the student to read the notes. Ifa student reads the anecdotal notes, he/she may be asked 
to sign the notes to acknowledge that the notes have been read. When a student appeals a failing 
grade, the Dean of Health Sciences and Human Services may request a justification from the 
professor for this failing grade and the anecdotal notes may be used for this more detailed 
explanation of the grade assigned. 


The College advised the complainant that, while in her case the anecdotal notes she requested 
had been destroyed, it was the current practice of the professors to retain the anecdotal notes for 


one year in case there was an appeal of a failing grade and after one year all anecdotal notes are 
destroyed. 


Based upon this information, in our view, the anecdotal notes were in the custody and under the 
control of the College. 


Conclusion: The anecdotal notes were in the custody and under the control of the 
College. 
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Issue C: Was the personal information retained by the College in accordance with 
section 5(1) of Regulation 460 under the Act, as amended by Regulation 
532/93? 


Section 5(1) of Regulation 460, as amended by Regulation 532/93, states: 


Personal information that has been used by an institution shall be retained by the 
institution for at least one year after use unless the individual to whom the 
information relates consents to its earlier disposal. 


On December 29, 1992, the complainant requested copies of the anecdotal notes for the March 
9 to May 1, 1992 semester, from the College. She was informed on January 26, 1993, by the 
Dean, Health Sciences and Human Services, that the anecdotal notes for that period had been 
destroyed. On March 4, 1993, she made a request under the Act for access to the anecdotal 
notes. The College responded to the access request by saying that all anecdotal notes prepared 
by the complainant’s professor (except those for current students) had been destroyed. The 
College maintained that this was not done purposely to prevent the complainant from receiving 
copies. 


The College provided our office with a copy of a policy entitled "Retention of Records and 
Correspondence". This policy states that the retention of instructors’ records of student grades 
for tests, assignments and other activities on which end-of-the-semester grades are based must 
be retained by instructors for the period of time specified in the policy entitled "Course Grade 
System for Recording Academic Standing". While the College informed the complainant that 
it was the current practice of the professor to retain the anecdotal notes for one year, the portion 
of the policy relevant to this matter states that the information must be retained for at least one 
semester following the semester to which the notes apply, for use in the event of appeals against 
the grade. The policy does not state that the notes must be retained for one year. 


Since the anecdotal notes were used to prepare the complainant’s final clinical evaluation, and 
the notes were dated from March 9 to May 1, 1992, the anecdotal notes would have last been 
used by the professor in May 1992. When the complainant initially wrote to the College 
requesting the anecdotal notes, she was informed on January 26, 1993, that the anecdotal notes 
had been destroyed. It is our view that, since the complainant did not consent to the notes 
earlier disposal, the College did not retain the anecdotal notes for the prescribed minimum 
period of one year after use. 


In our view, the College’s retention of the anecdotal notes, containing the complainant’s personal 
information, was not in accordance with section 5(1) of Regulation 460. 


Conclusion: The College’s retention of the personal information was not in accordance 
with section 5(1) of Regulation 460, as amended by Regulation 532/93. 
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Issue D: Were reasonable measures in place to prevent unauthorized access to the 
personal information in accordance with section 4(1) of Regulation 460 under 
the Act, as amended by Regulation 532/93? 


Section 4(1) of Regulation 460, as amended by Regulation 532/93, states that: 


(1) Every head shall ensure that reasonable measures to prevent unauthorized 
access to the records in his or her institution are defined, documented and put in 
place, taking into account the nature of the records to be protected. 


The complainant questioned the security of the anecdotal notes while they were maintained by 
the College. She stated that the notes were kept in a binder readily accessible to all College 
students. 


In our view, the College has a responsibility to ensure that its policies and procedures regarding 
the maintenance and security of the anecdotal notes adhere to the requirements set out in section 
4(1) of the Regulation. 


In this regard, the College has stated that anecdotal notes are not “readily accessible" to 
students, nor are they readily accessible to other employees of the College. Professors may keep 
anecdotal notes together in a binder but there is an understanding that anecdotal notes contain 
private and confidential information which is not accessible to anyone other than the faculty 
member and is shared only with the individual students. Any information that is revealed to any 
one student would only be his/her own. 


The College informed us that there is no policy which dictates how nursing professors should 
maintain anecdotal notes. However, it has been communicated to faculty members at divisional 
meetings that they are expected to take appropriate precautions to safeguard the anecdotal notes. 


It is our view that while the College may have communicated to faculty members the importance 
of safeguarding the anecdotal notes, any reasonable measures to prevent unauthorized access to 
the personal information contained in the notes have not been defined, documented and put in 
place as required in section 4(1) of Regulation 460. 


Conclusion: Reasonable measures were not defined, documented and put in place to 


prevent unauthorized access to the personal information, in accordance 
with section 4(1) of Regulation 460, as amended by Regulation 532/93. 


SUMMARY OF CONCLUSIONS 


& The information in question was personal information as defined in section 2(1) of the 
Act. 
& The anecdotal notes were in the custody and under the control of the College. 
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e The College’s retention of the personal information was not in accordance with section 
5(1) of Regulation 460, as amended by Regulation 532/93. 

e Reasonable measures were not defined, documented and put in place to prevent 
unauthorized access to the personal information, in accordance with section 4(1) of 
Regulation 460, as amended by Regulation 532/93. 

RECOMMENDATIONS 


We recommend that: 


1) 


2) 


3) 


the College amend its policy on "Course Grade System for Recording Academic 
Standing" to include the anecdotal notes, and to ensure that the anecdotal notes are 
retained in accordance with section 5(1) of Regulation 460 under the Act, as amended 
by Regulation 532/93. 


the College ensure that measures are in place to prevent unauthorized access to the 
anecdotal notes and that these measures are "defined" and "documented" as required by 
section 4(1) of Regulation 460 under the Act, as amended by Regulation 532/93. 


the College ensure that all professors are made aware of the above policy amendments 
and security measures when they have been implemented. 


Within six months of receiving this report, the College should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 


recommendations. 
Original signed by: January 6, 1994 
Susan Anthistle Date 


Compliance Review Officer 


2K OK KOK 


[IPC Investigation [93-083P/January 6, 1994] 


Information and Privacy 
Commissioner/Ontario 


Commissaire a l'information 
et a la protection de la vie privée/Ontario 


CAZON 


INVESTIGATION REPORT 


»d INVESTIGATION 193-083P 


A COLLEGE OF APPLIED ARTS AND TECHNOLOGY 


80 Bloor Street West, 80, rue Bloor ouest 416-326-3333 
ma Suite 1700, Bureau 1700 1-800-387-0073 
Toronto, Ontario Toronto (Ontario) Fax/Teléc: 416-325-9195 


et = M5S 2V1 M5S 2V14 


Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontario, 5th Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toll free in 
Ontario 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de l'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1NB8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d'interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du trésorier de l'Ontario. Paiement exigé d’avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a College of Applied Arts 
and Technology (the College). 


The complainant had been a student in the College’s nursing program. In the College’s nursing 
division it was the practice of the professors to prepare anecdotal notes for each student. These 
anecdotal notes were reviewed by the students in weekly assessments with the professors, and 
were used in the preparation of the students’ final evaluations. The complainant requested 
access to her anecdotal notes and was informed by the College that these notes had been 
destroyed. 


The complainant was concerned that the College had prematurely destroyed the anecdotal notes, 
containing her personal information, contrary to the Freedom of Information and Protection of 
Privacy Act (the Act). She was also concerned about the security of the anecdotal notes, stating 
that the notes were kept in a binder readily accessible to all College students. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Were the anecdotal notes in the custody or under the control of the College? If 
yes, 


(C) Was the personal information retained by the College in accordance with section 
5(1) of Regulation 460 under the Act, as amended by Regulation 532/93? 


(D) Were reasonable measures in place to prevent unauthorized access to the personal 


information in accordance with section 4(1) of Regulation 460 under the Act, as 
amended by Regulation 532/93? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 
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(g) the views or opinions of another individual about the individual, and 


(h) the individual’s name where it appears with other personal information 
relating to the individual... 


The anecdotal notes consisted of written evaluations about the complainant made by the 
complainant’s professor. 


In our view, this information met the requirements in paragraphs (g) and (h) of the definition 
of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Were the anecdotal notes in the custody or under the control of the College? 


In this case, the complainant was informed by the College that the anecdotal notes she had 
requested had been destroyed. However, she was also informed that the anecdotal notes were 
the professors’ personal notes, prepared by the professors for their own use, and were, 
therefore, not in the custody or control of the College. 


Therefore, before we address the complainant’s concerns, we must determine whether the 
anecdotal notes were in the custody or under the control of the College, within the context of 
the Act. Accordingly, we have reviewed pages 10-12 of Order 120, where former 
Commissioner Sidney B. Linden made the following statement: 


In my view, it is not possible to establish a precise definition of the words 
"custody" or "control" as they are used in the Act, and then simply apply those 
definitions in each case. Rather, it is necessary to consider all aspects of the 
creation, maintenance and use of particular records, and to decide whether 
"custody" or "control" has been established in the circumstances of a particular 
fact situation. 


Commissioner Linden went on to provide the following non-exhaustive list of factors which can 
be of assistance in determining whether an institution has "custody" and/or "control" of records 
in particular situations: 


iB, Was the record created by an officer or employee of the institution? 
Zz What use did the creator intend to make of the record? 
ay Does the institution have possession of the record, either because it has 


been voluntarily provided by the creator or pursuant to a mandatory 
statutory or employment requirement? 
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4. If the institution does not have possession of the record, is it being held 
by an officer or employee of the institution for the purposes of his or her 
duties as an officer or employee? 


5. Does the institution have a right to possession of the record? 

6. Does the content of the record relate to the institution’s mandate and 
functions? 

ee Does the institution have the authority to regulate the record’s use? 

8. To what extent has the record been relied upon by the institution? 


She How closely is the record integrated with other records held by the 
institution? 


10. Does the institution have the authority to dispose of the record? 


We have reviewed these factors while considering the College’s position. It is our view that the 
anecdotal notes were in the custody and under the control of the College. 


Anecdotal notes are written and retained by the professors to assist them in the preparation of 
the final written clinical evaluations for the students. The clinical evaluations reflect the success 
or failure of the student in the clinical nursing course. The College does, in fact, recognize 
clinical evaluations, created from the anecdotal notes, as College records, in the custody and 
under the control of the College. 


During the weekly assessment of the students, the professors refer to the anecdotal notes and 
allow the student to read the notes. Ifa student reads the anecdotal notes, he/she may be asked 
to sign the notes to acknowledge that the notes have been read. When a student appeals a failing 
grade, the Dean of Health Sciences and Human Services may request a justification from the 
professor for this failing grade and the anecdotal notes may be used for this more detailed 
explanation of the grade assigned. 


The College advised the complainant that, while in her case the anecdotal notes she requested 
had been destroyed, it was the current practice of the professors to retain the anecdotal notes for 


one year in case there was an appeal of a failing grade and after one year all anecdotal notes are 
destroyed. 


Based upon this information, in our view, the anecdotal notes were in the custody and under the 
control of the College. 


Conclusion: The anecdotal notes were in the custody and under the control of the 
College. 
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Issue C: Was the personal information retained by the College in accordance with 
section 5(1) of Regulation 460 under the Act, as amended by Regulation 
532/93? 


Section 5(1) of Regulation 460, as amended by Regulation 532/93, states: 


Personal information that has been used by an institution shall be retained by the 
institution for at least one year after use unless the individual to whom the 
information relates consents to its earlier disposal. 


On December 29, 1992, the complainant requested copies of the anecdotal notes for the March 
9 to May 1, 1992 semester, from the College. She was informed on January 26, 1993, by the 
Dean, Health Sciences and Human Services, that the anecdotal notes for that period had been 
destroyed. On March 4, 1993, she made a request under the Act for access to the anecdotal 
notes. The College responded to the access request by saying that all anecdotal notes prepared 
by the complainant’s professor (except those for current students) had been destroyed. The 
College maintained that this was not done purposely to prevent the complainant from receiving 
copies. 


The College provided our office with a copy of a policy entitled "Retention of Records and 
Correspondence". This policy states that the retention of instructors’ records of student grades 
for tests, assignments and other activities on which end-of-the-semester grades are based must 
be retained by instructors for the period of time specified in the policy entitled "Course Grade 
System for Recording Academic Standing". While the College informed the complainant that 
it was the current practice of the professor to retain the anecdotal notes for one year, the portion 
of the policy relevant to this matter states that the information must be retained for at least one 
semester following the semester to which the notes apply, for use in the event of appeals against 
the grade. The policy does not state that the notes must be retained for one year. 


Since the anecdotal notes were used to prepare the complainant’s final clinical evaluation, and 
the notes were dated from March 9 to May 1, 1992, the anecdotal notes would have last been 
used by the professor in May 1992. When the complainant initially wrote to the College 
requesting the anecdotal notes, she was informed on January 26, 1993, that the anecdotal notes 
had been destroyed. It is our view that, since the complainant did not consent to the notes 
earlier disposal, the College did not retain the anecdotal notes for the prescribed minimum 
period of one year after use. 


In our view, the College’s retention of the anecdotal notes, containing the complainant’s personal 
information, was not in accordance with section 5(1) of Regulation 460. 


Conclusion: The College’s retention of the personal information was not in accordance 
with section 5(1) of Regulation 460, as amended by Regulation 532/93. 
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Issue D: Were reasonable measures in place to prevent unauthorized access to the 
i personal information in accordance with section 4(1) of Regulation 460 under 
the Act, as amended by Regulation 532/93? 


Section 4(1) of Regulation 460, as amended by Regulation 532/93, states that: 


(1) Every head shall ensure that reasonable measures to prevent unauthorized 
access to the records in his or her institution are defined, documented and put in 
place, taking into account the nature of the records to be protected. 


The complainant questioned the security of the anecdotal notes while they were maintained by 
the College. She stated that the notes were kept in a binder readily accessible to all College 
students. 


In our view, the College has a responsibility to ensure that its policies and procedures regarding 
the maintenance and security of the anecdotal notes adhere to the requirements set out in section 
4(1) of the Regulation. 


In this regard, the College has stated that anecdotal notes are not "readily accessible" to 
students, nor are they readily accessible to other employees of the College. Professors may keep 
anecdotal notes together in a binder but there is an understanding that anecdotal notes contain 
private and confidential information which is not accessible to anyone other than the faculty 
member and is shared only with the individual students. Any information that is revealed to any 
one student would only be his/her own. 


The College informed us that there is no policy which dictates how nursing professors should 
maintain anecdotal notes. However, it has been communicated to faculty members at divisional 
meetings that they are expected to take appropriate precautions to safeguard the anecdotal notes. 


It is our view that while the College may have communicated to faculty members the importance 
of safeguarding the anecdotal notes, any reasonable measures to prevent unauthorized access to 
the personal information contained in the notes have not been defined, documented and put in 
place as required in section 4(1) of Regulation 460. 


Conclusion: Reasonable measures were not defined, documented and put in place to 


prevent unauthorized access to the personal information, in accordance 
with section 4(1) of Regulation 460, as amended by Regulation 532/93. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The anecdotal notes were in the custody and under the control of the College. 
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e The College’s retention of the personal information was not in accordance with section 
5(1) of Regulation 460, as amended by Regulation 532/93. 

e Reasonable measures were not defined, documented and put in place to prevent 
unauthorized access to the personal information, in accordance with section 4(1) of 
Regulation 460, as amended by Regulation 532/93. 

RECOMMENDATIONS 


We recommend that: 


1) 


2) 


3) 


the College amend its policy on "Course Grade System for Recording Academic 
Standing" to include the anecdotal notes, and to ensure that the anecdotal notes are 
retained in accordance with section 5(1) of Regulation 460 under the Act, as amended 
by Regulation 532/93. 


the College ensure that measures are in place to prevent unauthorized access to the 
anecdotal notes and that these measures are "defined" and "documented" as required by 
section 4(1) of Regulation 460 under the Act, as amended by Regulation 532/93. 


the College ensure that all professors are made aware of the above policy amendments 
and security measures when they have been implemented. 


Within six months of receiving this report, the College should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 


recommendations. 
Original signed by: January 6, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ontario Human Rights 
Commission (the OHRC). 


The OHRC was conducting an investigation into a complaint against a named library (the 
Library) filed by an employee of the Library. During the course of the OHRC investigation, 
the complainant, also an employee of the Library, was asked by the OHRC for her racial 
background. When she refused, she was advised by the OHRC that the information in question 
was already contained in its records. 

The complainant was concerned that the OHRC’s collection of personal information was contrary 
to the Freedom of Information and Protection of Privacy Act (the Act). She was also concerned 


that the OHRC had collected her personal information indirectly, contrary to section 39(1) of 
the Act. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the OHRC’s collection of the personal information in accordance with 
section 38(2) of the Act? 


(C) Was section 39(1) of the Act applicable? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
age, sex, sexual orientation or marital or family status of the individual, 
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The information in question was about the racial backgrounds of the complainant and the other 
Library employees. 


In our view, this information met the requirements in paragraph (a) of the definition of personal 
information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the OHRC’s collection of the personal information in accordance with 
section 38(2) of the Act? 


Section 38(2) of the Act sets out the conditions under which personal information may be 
collected on behalf of an institution. This section states: 


(2) No person shall collect personal information on behalf of an institution unless 
the collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The OHRC has stated that its collection of the racial background information involved all of the 
employees of the Library in the immediate work area of the employee who had filed the OHRC 
complaint, including the complainant. The OHRC advised us that the racial background 
information was collected from the Library employees to be used for the purposes of law 
enforcement. The OHRC has relied on previous Orders issued by this Office. In Order 200, 
then Assistant Commissioner Tom Wright stated: 


Both Commissioner Sidney B. Linden and I have found that investigations into 
complaints made under the Human Rights Code, 1981, S.O. 1981 c. 53 (the 
"Code") are properly considered law enforcement matters and that these 
investigations may lead to proceedings before a Board of Inquiry under the Code, 
which are properly considered law enforcement proceedings. [See Order 89 
(Appeal Number 890024), dated September 7, 1989 and Order 178 (Appeal 
Number 890112), dated June 12, 1990.] 


The OHRC complaint involved an alleged contravention of section 5(1) of the Ontario Human 
Rights Code R.S.O. 1990. This section states, in part, that "Every person has a right to equal 
treatment with respect to employment without discrimination because of race, ancestry, place 
of origin, colour...". The OHRC advised us that the OHRC complaint against the Library 
specifically related to discrimination because of race and colour. As part of the investigation, 
the complainant, as well as the other employees of the Library in the immediate work area of 
the employee who filed the OHRC complaint, were asked for their racial backgrounds. In the 
complainant’s case, she refused to provide her racial background to the OHRC. 


[IPC Investigation 193-084P/February 16, 1994] 


beats 


However, the OHRC’s collection of the other employees’ racial background information was for 
the purpose of pursuing the investigation of the complaint under the Code. Since we have found 
that investigations into complaints made under the Code are considered law enforcement matters, 
it is our view, therefore, that the OHRC’s collection of this personal information was used for 
the purposes of law enforcement, in accordance with section 38(2) of the Act. 


Conclusion: The OHRC’s collection of personal information was in accordance with 
section 38(2) of the Act. 


Issue C: Was section 39(1) of the Act applicable? 


Section 39(1) of the Act provides that personal information shall only be collected by an 
institution directly from the individual to whom the information relates unless certain 
circumstances apply. (See Appendix A for full text). 


The complainant was concerned that the OHRC had indirectly collected information about her 
racial background contrary to the provisions of section 39(1). She informed us that when she 
had refused to provide this information, the OHRC investigating officer had stated that the 
OHRC already had her racial background, and that he was attempting to confirm that this 
information was correct. 


The OHRC advised that the investigating officer, who had been assigned the task of collecting 
the personal information, may have misunderstood the instructions given to him. Both the 
investigating officer and his supervisor assured our office that the OHRC had no information in 
its records regarding the complainant’s racial background. According to the OHRC, the 
complainant had been falsely advised by the investigating officer that the OHRC already had her 
personal information. The OHRC informed us that it was sending a letter to the complainant, 
explaining the matter. The complainant was advised of this and was satisfied that the OHRC 
did not have information about her racial background in its records. 


Since there was no indirect collection of the complainant’s racial background, section 39(1) of 
the Act did not apply. 


Conclusion: The OHRC did not indirectly collect information about the complainant’s 


racial background, therefore, section 39(1) of the Act did not apply to this 
personal information. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
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e The OHRC’s collection of personal information was in accordance with section 38(2) of 
the Act. ‘ 

e The OHRC did not indirectly collect information about the complainant’s racial 
background, therefore, section 39(1) of the Act did not apply to this personal 
information. 

Original signed by: February 16, 1994 

Susan Anthistle Date 


Compliance Review Officer 
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APPENDIX A 


39.-(1) Personal information shall only be collected by an institution directly from the individual 
to whom the information relates unless, 


(a) 
(b) 


(c) 


(d) 


(e) 


(f) 


(g) 
(h) 


the individual authorizes another manner of collection; 

the personal information may be disclosed to the institution concerned under 
section 42 or under section 32 of the Municipal Freedom of Information and 
Protection of Privacy Act, 1989; 


the Commissioner has authorized the manner of collection under clause 59(c); 


the information is in a report from a reporting agency in accordance with the 
Consumer Reporting Act; 


the information is collected for the purpose of determining suitability for an 
honour or award to recognize outstanding achievement or distinguished service; 


the information is collected for the purpose of the conduct of a proceeding or a 
possible proceeding before a court or judicial or quasi-judicial tribunal; 


the information is collected for the purpose of law enforcement; or 


another manner of collection is authorized by or under a statute. 


A-1 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of 
Transportation (the Ministry). The complainant had applied to renew his driving licence at a 
Ministry of Transportation licensing office administered by a private issuer. Private issuers are 
under contract to the Ministry to issue driver licences and motor vehicle permits under 
subsection 7(11) of the Highway Traffic Act. 


The complainant wished to pay for his licence by cheque. The private issuer requested the 
complainant’s telephone number, as a condition for acceptance of his cheque. The complainant 
stated that his cheque was eventually accepted, without the collection of his telephone number. 
However, the complainant obtained from the Ministry a copy of their policy on cheque 
acceptance. He objected to the statement "Issuers may accept cheques at their discretion, but 
must follow Ministry policy if they do so." The complainant’s concern was that in his view, 
this statement allowed private issuers unlimited discretion to collect any type of personal 
information from driver licence applicants, in contravention of the Freedom of Information and 
Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) _ Did the private issuer collect the personal information on behalf of the Ministry 
in accordance with section 38(2) of the Act? 


RESULTS OF THE INVESTIGATION 
Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part as: 


recorded information about an identifiable individual, including, 
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(d) the address, telephone number, fingerprints or blood type of the individual, 
(emphasis added) 


It is our view that the complainant’s telephone number met the requirements of paragraph (d) 
of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The complainant’s telephone number was personal information as defined 
in section 2(1) of the Act. 


Issue B: Did the private issuer collect the personal information on behalf of the 
Ministry in accordance with section 38(2) of the Act? 


In order to determine if private issuers are governed by the Act, either as "institutions" under 
the Act or as "agents" of the Ministry, we reviewed a copy of the Memorandum of Agreement 
which is a contract between the Minister of Transportation and private issuers. Under Paragraph 
1 of the Memorandum, the Minister appoints the issuer to be an agent of the Minister to issue 
motor vehicle permits. Under paragraph 1 of the Addendum to the Memorandum, the issuer 
is appointed to issue driver licences. 


Paragraph 2 of the Memorandum states that the issuer will comply with all legislation governing 
the issuance of permits and licences; with the Ministry’s manuals, policies, instructions and 
directives, and with the Ministry’s reporting requirements in a manner that allows immediate 
revenue reconciliation. Paragraph 13 states, in part, that the issuer will not engage in any 
activity or business in which the issuer’s interests will conflict with the interests of the Ministry, 
and paragraph 2 of the Addendum states that the issuer shall comply with all legislation and 
regulations governing the issuance of drivers’ licences as set out in the policies, procedures and 
directives published from time to time by or under the authority of the Minister. 


It is our view that, therefore, private issuers may be considered to be agents of the Ministry for 
the purposes of the Act, as it relates to the collection of personal information for the purposes 
of issuing driver licences and motor vehicle permits. 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


Under Ministry policy, private issuers may accept cheques at their discretion, provided that they 


follow the criteria for accepting cheques. An acceptable cheque must include the signature of 
the account owner (or authorized person), bank name, branch and account number. It must be 
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legible, made payable to the Minister of Finance etc. The Ministry’s policy does not state that 
an acceptable cheque must also have the telephone number of the applicant. 


The complainant advised that subsequent to conversations with Ministry staff, and with 
individuals at the private issuer’s licensing office, he was able to pay for his licence by cheque, 
without having to provide his telephone number. The complainant, however, was of the view 
that the collection of personal information for acceptance of cheques should be restricted to only 
the information essential to the renewal of the licence. He felt that the Ministry’s policy on the 
acceptance of cheques should be revised so that private issuers could not request telephone 
numbers, or other such personal data. 


The Ministry was of the opinion that private issuers, as small business operators, should be 
allowed flexibility in the conduct of their business, and that the revision of the policy to define 
precisely what information may be collected, as suggested by the complainant, would be too 
intrusive. Nevertheless, the Ministry stated that they had no intent or desire to collect telephone 
numbers from driver licence applicants, and that it was not a common practice to do so. 


In our view, the issuance of drivers’ licences and motor vehicle permits by private issuers on 
behalf of the Ministry is a lawfully authorized activity. It is also our view that the collection 
of personal information for the acceptance of a cheque such as the signature of the account 
owner, the name of his/her bank, branch and account number, is necessary to the process of 
issuing a driver’s licence or a motor vehicle permit. The collection of this information is, 
therefore, in accordance with section 38(2) of the Act. However, it is our view that the 
collection of the telephone number is not necessary to the issuance of a licence or a permit. In 
this case, the private issuer, on behalf of the Ministry, did not collect the complainant’s 
telephone number for cheque acceptance. If the private issuer had done so, the collection of this 
personal information would not have been in accordance with section 38(2) of the Act. 


Conclusion: If the private issuer had collected, on behalf of the Ministry, the 
complainant’s telephone number for cheque acceptance, the collection of 
this personal information would not have been in accordance with section 
38(2) of the Act. 


SUMMARY OF CONCLUSIONS 


e The complainant’s telephone number was personal information as defined in section 2(1) 
of the Act. 


e If the private issuer had collected, on behalf of the Ministry, the complainant’s telephone 
number for cheque acceptance, the collection of this information would not have been 
in accordance with section 38(2) of the Act. 
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RECOMMENDATIONS 


During the course of this investigation, the Ministry offered to send an electronic bulletin to all 
private issuers, stressing that the only criteria for accepting cheques were those listed in the 
policy. In our view, this action would minimize the likelihood of future requests by private 


issuers for applicants’ telephone numbers. The Ministry also offered to send a paper copy of 
the bulletin to the complainant. 


We, therefore, recommend that the Ministry: 

Le Implement its proposal to issue an electronic bulletin to all private issuers, stressing that 
the only criteria for accepting cheques are those listed in the Ministry’s cheque 
acceptance policy and to send a paper copy to the complainant. The electronic bulletin 


should include a reference to section 38(2) of the Act. 


oa Send a copy of this report to the private issuer who requested the complainant’s telephone 
number. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Susan Anthistle Date 
Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named separate school 
board (the Board). 


The complainant, a teacher with the Board, said that after an incident at the school, she went 
on sick leave. While on sick leave, the Board sent her two forms for her signature. One form 
(form A) required the complainant to authorize the collection of her medical information from © 
her own physician, including "any and all medical information, documents, records or history" 
which might be required by the Board’s physician. The other form (form B) authorized the 
Board’s physician to disclose his report based on his medical examination of the complainant to 
the Board’s Superintendent of Education, Personnel Services (Superintendent) or to her 
designate, the Assistant Superintendent. The Board advised the complainant that these were 
standard consent forms. 


The complainant was reluctant to sign the consent forms which she considered to be invasive and 
in contravention of the Municipal Freedom of Information and Protection of Privacy Act (the 
Act). However, she received a letter from the Superintendent stating that she could not return 
to work until the Board’s physician had received the completed consent forms and had sent his 
report to the Board (i.e., to the Assistant Superintendent). 


The complainant signed form B but revised form A, narrowing it to make it specific to the 
medical information related to the incident which had precipitated her sick leave. The Board 
accepted the complainant’s revised form (form C). The complainant stated that she had signed 


forms B and C, thereby giving her consent to the collection and disclosure of her medical 
information, only “under coercion" -- in order that she could return to work. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Board’s proposed collection of personal information through form A in 
compliance with section 28(2) of the Act? 


(C) | Was the Board’s collection of personal information through form C in compliance 
with section 28(2) of the Act? 


(D) | Was the Board’s indirect collection of personal information in compliance with 
section 29(1) of the Act? 
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(E) Was the disclosure of personal information by the Board’s physician to the 
Assistant Superintendent in compliance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, 


(g) the views or opinions of another individual about the individual, arid 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The medical report completed by the Board’s physician contained the complainant’s name and 
a description of her physical and emotional state, as well as the physician’s opinion that she was 
physically able to return to her teaching duties. 


In our view, the personal information in the medical report met the requirements of paragraphs 
(g) and (h) of the definition of "personal information" in section 2(1) of the Act. 


The information obtained by the Board through form C was medical information relating to the 
specific incident which resulted in the complainant’s leave of absence. This information met the 
requirements of paragraph (h) of the definition of "personal information" in section 2(1) of the 
Act. 


The information that the Board had intended to obtain through form A was "any and all medical 
information, documents, records of history" in the possession of the complainant’s doctor 
relating to the complainant, as required by the Board’s physician for the purpose of completing 
his examination and writing his report. It is our view that this information would have met the 
requirements of paragraphs (b), (g), and (h) of the definition of "personal information" in section 
2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 
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Issue B: Was the Board’s proposed collection of personal information through form 
A in compliance with section 28(2) of the Act? 


While no personal information was actually collected through form A, the Board nonetheless 
intended (and normally collected) personal information using this form. In asking the 
complainant to sign it, the Board was seeking her consent to collect “any and all medical 
information, documents, records or history" relating to her as required by the Board’s physician. 
Therefore, we examined whether the Board’s intended collection of the complainant’s personal 
information through form A would have been in compliance with section 28(2) of the Act. 


Section 28(2) of the Act states: 


(2) No person shall collect personal information on behalf of an institution unless 
the collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Board cited section 171(1) of the Education Act, which states in part that a Board may: 


appoint and remove such teachers, as it considers expedient, determine the terms 
on which such officers, servants and teachers are to be employed, prescribe their 
duties and fix their salaries. 


The Board advised that it administered and funded employee sick leave benefits. The Board 
stated that its collection of the complainant’s medical information was necessary to the proper 
administration of a lawfully authorized activity, i.e. the administration of these employee 
benefits. It is our view that the Board’s administration of employee benefits as part of its 
management of human resources was a lawfully authorized activity. 


However, it is also our view that the extremely broad wording contained in form A could have 
led to the collection of medical information that would not have been specifically related to the 
incident precipitating the complainant’s sick leave, and for which sick benefits were being 
received. In this particular case, the Board accepted a narrower, more privacy-protective 
version of form A (form C) from the complainant, which only collected information related to 
the precipitating incident. The Board considered this to be sufficient. Had the Board collected 
all the personal information set out in form A, some of which would not have been specifically 
related to the precipitating incident, we do not believe the Board’s collection would have been 
restricted to what was truly “necessary" to the proper adminstration of a lawfully authorized 
activity. Accordingly, the collection of the broad spectrum of medical information required 
through form A (“any and all medical information, documents, records or history") would not 
have been in compliance with section 28(2) of the Act. 


Conclusion: The Board’s proposed collection of the complainant’s personal information 


through form A wouid not have been in compliance with section 28(2) of 
the Act. 
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Issue C: Was the Board’s collection of personal information through form C in 
compliance with section 28(2) of the Act? 


The Board collected the complainant’s medical information through her revised form C. This 
information was related to the incident which had directly resulted in her leave of absence. 


As previously stated, it is our view that the Board’s administration of employee benefits as part 
of its management of human resources was a lawfully authorized activity. It is also our view 
that the collection of medical information relating to the incident which precipitated the 
complainant’s sick leave was necessary to the proper administration of this lawfully authorized 
activity, in order to determine the appropriate benefits. Therefore, the Board’s collection of the 
complainant’s personal information through form C was in compliance with section 28(2) of the 
Act. 
Conclusion: The Board’s collection of the complainant’s personal information through 
form C was in compliance with section 28(2) of the Act. 


Issue D: Was the Board’s indirect collection of personal information in compliance 
with section 29(1) of the Act? 


Section 29(1)(a) of the Act states: 


An institution shall collect personal information only directly from the individual 
to whom the information relates unless, 


(a) the individual authorizes another manner of collection. 


The complainant said that she had not wanted to sign the consent forms but felt she had been 
given no choice: she said she signed the consent forms "under coercion". She had been 
informed in the letter from the Board’s Superintendent that she could not return to work unless 
the forms were signed. The Board also confirmed that employees were required to sign the 
forms before receiving or continuing to receive sick leave benefits, or being permitted to return 
to work. 


For the purpose of comparison, we contacted another separate school board to determine if its 
policies regarding the collection of employee medical information were the same. We were told 
that for short term illness, employees may be asked to obtain a medical certificate from their 
doctor. For long term illness, "an extended sick leave claim" form and an attending physician’s 
statement are sent to the employee. Both forms require administrative details, but with a 
minimum of medical information. The attending physician’s statement requires the attending 
physician to complete the statement and give it directly to the patient. The patient then returns 
both the sick leave claim form and the physician’s statement to the school board. 


It is our view that had the complainant been allowed to obtain the required medical information 
directly from her doctor to pass on to the Board, she would have been in a better position to 
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protect her privacy, with no detriment to the fulfilment of the Board’s legitimate need for this 
information. She would have had the opportunity to discuss the need for any medical 
information unrelated to the precipitating incident, with her own physician prior to forwarding 
the report to the Board. 


For consent to be truly meaningful, that consent must be given on an informed basis and must 
be given voluntarily. This is the hallmark of consent -- that it be voluntary in nature. If consent 
is not both informed and voluntary, its value is diminished so greatly that, in our view, it may 
be rendered meaningless. 


In the circumstances of this particular case, the complainant signed Form C, a narrowed version 
of Form A, which the complainant had refused to sign in its entirety. The complainant herself 
revised Form A (presumably, to her satisfaction), transforming it into Form C. By signing 
Form C, however, the complainant in effect authorized the Board’s indirect collection of her 
medical information from her physician. Under the pressured circumstances faced by the 
complainant, we question just how "voluntarily" consent was actually given. However, the 
signed Form C enabled the Board to collect the complainant’s personal information, in technical 
compliance with section 29(1)(a), 1.e., where the individual authorizes another manner of 
collection. Nonetheless, we find this approach to obtaining authorization to be objectionable, 
and not in keeping with the spirit of the Act. 


Conclusion: The Board’s indirect collection of the complainant’s personal information 
was in technical compliance with section 29(1) of the Act. 


‘ 


Issue E: Was the disclosure of personal information by the Board’s physician to the 
Assistant Superintendent, in compliance with section 32 of the Act? 


Under the Act, an institution may not disclose information in its custody or under its control 
except in the specific circumstances outlined in section 32. 


Section 32(c) of the Act states: 


An institution shall not disclose personal information in its custody or under its control 
except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


The Board stated that one of the terms of employment with the Board requires a teacher to be 
examined by a Board physician at any time before an allowance for sick leave or benefits are 
given. The Board advised that section 23.04(c) of the Collective Agreement between the 
teachers’ union and the Board stated: 


The Board may require the teacher to be examined by a medical or dental 
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practitioner of the Board’s own choice at any time before any allowance for sick 
leave is given or while benefits from the plan are being received. 


The complainant was examined by the Board’s physician, whose report was then disclosed to 
the Assistant Superintendent. 


It is our view that one of the purposes for which the Board’s physician had obtained the 
complainant’s medical information (contained in his report) was to determine whether the 
complainant was physically and mentally ready to return to work, or whether she should remain 
on sick leave and in receipt of benefits.. The Board’s physician then disclosed his report to the 
Assistant Superintendent to inform her that in his view, the complainant was ready to return to 
work.: Since the Board’s physician disclosed the complainant’s medical information for the same 
purpose for which he had obtained it, we view his disclosure as being in compliance with section 
32(c) of the Act. 


Conclusion: The disclosure of the complainant’s personal information by the Board’s 
physician to the Assistant Superintendent was in compliance with section 
32 of the Act. 


Other Matters 
Access and Retention of Personal Information 


During the course of our investigation, the complainant also raised several concerns about who 
would have access to her official personnel file and how long the medical report would be 
retained in the file. 


The Board provided us with the following information: 
Access to Personnel Files: 


Staff who have access to personnel files include the Superintendent of Education, Personnel 
Services; the Assistant Superintendent of Education, Personnel Services; personnel staff who deal 
with the specific category of employee in question; the appropriate support staff in Personnel, 
i.e. Personnel Records Officer, Secretary to the Superintendent; and upon request, the 
Superintendent of Education, Schools, who is responsible for the school in which the teacher is 
assigned. 


Section 4(2) of Regulation 823 under the Act provides that "Every head shall ensure that only 
those individuals who need a record for the performance of their duties shall have access to it." 


It is our view that the above personnel may require access to the complainant’s personnel file 


from time to time, for the performance of their duties. In particular, those staff who were 
involved in the administration of her medical benefits would need access to the medical report 
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in her file. However, we would ask the Board to ensure that only those individuals who 
specifically need to access an employee’s medical information, be permitted to do so. 


Retention of Personal Information: 


Employee records are retained permanently on microfilm. Employees’ active hard copy files, 
including medical records or consent forms, are retained in Personnel Services until their 
employment with the Board terminates. The Board sent us a copy of their retention schedule. 


Section 5 of Regulation 823 states that personal information that has been used by an institution 
"shall be retained by the institution for the shorter of one year after use or the period set out in 
a by-law or resolution made by the institution or made by another institution affecting the 
institution, unless the individual to whom the information relates consents to its earlier disposal”. 


While the Regulation provides for a minimum retention period, there are no restrictions on the 


length of retention periods. Therefore, the Board’s retention of an employee’s records until the 
termination of his/her employment would not be an infringement of this Regulation. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The Board’s proposed collection of the complainant’s personal information through form 


A would not have been in compliance with section 28(2) of the Act. 


@ The Board’s collection of the complainant’s personal information through form C was 
in compliance with section 28(2) of the Act. 


e The Board’s indirect collection of the complainant’s personal information was in technical 
compliance with section 29(1) of the Act. 


e The disclosure of the complainant’s personal information by the Board’s physician to the 
Assistant Superintendent was in compliance with section 32 of the Act. 


RECOMMENDATIONS 


We believe that the Board could have better protected the complainant’s privacy if: a) the 
complainant had been allowed to collect the medical information directly from her physician and 
submit it to the Board’s physician herself; and b) if she had been allowed to review and 
comment upon the Board’s physician’s report before it was sent to the Assistant Superintendent. 
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The complainant would have thus been able to object to the disclosure of any medical 
information she felt was not relevant under the circumstances. 


Therefore, we recommend that the Board amend its policies and procedures as follows: 


iy The Board’s physician should not collect medical information directly from an 
employee’s physician. The employee involved should be permitted to obtain the medical 
information from his/her own physician, to submit directly to the Board’s physician. 
(This would also eliminate the need for a consent form for this collection). | 


Zo The Board should allow the employee involved to review and comment on the Board’s 
physician’s medical report, prior to. sending it to Personnel Services. 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original signed by: ' September 14, 1994 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 


2K IK OK 
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INTRODUCTION 


Background of the Complaint 


A police chief (the complainant) wrote that his employer, a named police services board (the 
Board), had disclosed his personal information contrary to the provisions of the Municipal 
Freedom of Information and Protection of Privacy Act (the Act). He complained that the Board 
had faxed his September 1993 performance evaluation (the evaluation) to its solicitor. 
Subsequently, the Board’s solicitor sent the complainant’s lawyer a copy of this evaluation. The 
lawyer then sent the complainant a copy. 

The complainant stated that the Board had also wrongfully disclosed the evaluation to clerical 
staff who were involved in faxing/sending the evaluation to the solicitor, to the lawyer, and to 
himself. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the personal information in accordance with section 32 of 


the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states in part: 
“personal information" mreans recorded information about an_ identifiable 
individual, including, 
(g) the views or opinions of another individual about the individual, 
and 
(h) the individual’s name if it appears with other personal 
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information relating to the individual or where the 
disclosure of the name would reveal other personal 
information about the individual; 


We have reviewed a copy of the evaluation in question. The evaluation contained the 
complainant’s name together with the views and opinions of the Board relating to his job 
performance such as his management skills. It also included statements attributed to him. 


In our view, the information contained in the evaluation satisfied the requirements of the 
definition of personal information in paragraphs (g), and (h) of section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in section 2(1) 


of the Act. 


Issue B: Was the disclosure of the "personal information" in accordance with section 
32 of the Act? 


Under the Act, an institution shall not disclose personal information in its custody or under its 
control except in the specific circumstances outlined in section 32 (see Appendix A for full text). 
The Board’s Disclosure to its Solicitor 


The Board stated that it had relied on sections 31(b), 32(c), and 32(d) of the Act for this 
disclosure. In our view, section 32(c) was applicable. It states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) © for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


Section 33 of the Act further provides that: 
The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. 


However, where personal information has been collected indirectly from an individual (as in this 
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case), a consistent purpose would be one that was "reasonable compatible" with the purpose for 
which the personal information had been obtained or compiled. 


The Board stated that it had compiled the evaluation in question, and other personnel and 
performance reviews about the complainant to fulfil its mandate, as set out in section 31 of the 


Police Services Act (the PSA). In particular, the Board had relied on sections 31(c), (d), and 
(e) of the PSA which state: 


A board is responsible for the provision of police services and for law 
enforcement and crime prevention in the municipality and shall, 


(c) establish policies for the effective management of the police force; 


(d) recruit and appoint the chief of police and any deputy chief of police, and 
annually determine their remuneration and working conditions, taking their 
submissions into account; 


(e) direct the chief of police and monitor his or her performance; 


The Board stated that it had retained its solicitor to advise it in connection with the 
administration of police services. In order to fully instruct its solicitor so that he could provide 
the Board with advice, it was necessary for the Board to give its solicitor information regarding 
the operation of the police force and the complainant who was its chief of police. 


The Board further advised that on August 17, 1993, the Board had passed the following 
resolution: 


Be it resolved that Mr. [name of solicitor], the solicitor for the Police Services 
Board be authorized to contact the Solicitor General to request that the Ontario 
Police Commission hold a hearing to enquire into the performance of [name of 
complainant] as Chief of Police. 


On August 19, 1993, the solicitor wrote such a letter to the Ministry of the Solicitor General and 
Correctional Services (the Ministry) outlining the matters that the Board would be raising 
concerning the complainant’s performance. In order for the solicitor to do so, it was necessary 
for the Board to disclose the complainant’s personal information to him. 


The Board originally compiled the complainant’s personal information in the evaluation in order 
to fulfil its mandate under section 31 of the PSA. In our view, the Board’s subsequent 
disclosure of the complainant’s personal information to its solicitor so that he could advise and 
assist the Board in fulfilling its mandate was for a purpose which was “reasonably compatible" 
with the purpose for which the personal information had been compiled. Therefore, in our view, 
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the Board’s disclosure of the complainant’s personal information in the evaluation was for a 
consistent purpose and was, therefore, in accordance with section 32(c) of the Act. 


The Board’s Disclosure to a Clerical staff member 
The evaluation had been signed by three members of the Board (and the complainant). 


The complainant believed that the evaluation had been disclosed to a clerical employee who in 
turn had faxed it to the Board’s solicitor. However, the Board’s solicitor stated that one of the 
members who had signed the evaluation had faxed it to him. We found no evidence that the 
Board had disclosed the evaluation to any staff members. 


The. Board’s Solicitor’s Disclosure to the Complainant’s Lawyer 


The complainant stated that the evaluation had also been disclosed to the solicitor’s secretary, 
the complainant’s own lawyer, and his lawyer’s secretary who in turn had sent him a copy. We 
have not examined the actions of the complainant’s lawyer or his secretary since neither had 
been retained or were employed by the Board. 


With respect to the Board’s solicitor’s disclosure to the complainant’s lawyer, the Board advised 
that the complainant’s lawyer had contacted the solicitor and had informed him that he was 
representing the complainant. The Board’s solicitor (thorough his secretary) had then sent the 
complainant’s lawyer a copy of the evaluation and the Board’s letter to the Ministry as part of 
the full disclosure of the Board’s concerns with respect to the complainant’s performance. 


As previously stated, the Board had complied the complainant’s personal information in the 
evaluation to fulfil its mandate under the PSA. In our view, the disclosure by the Board’s 
solicitor to the complainant’s lawyer was for a purpose that was reasonably compatible with the 
purpose for which the personal information had been compiled. This disclosure was, therefore, 
for a consistent purpose, in accordance with section 32(c) of the Act. 


Conclusion: The Board’s disclosure of the complainant’s personal information to its 
solicitor was in accordance with section 32(c) of the Act. 


We found no evidence that the Board had disclosed the evaluation to any 
staff members. 


The Board’s solicitor’s disclosure to the complainant’s lawyer was in 
accordance with section 32(c) of the Act. 


Other Matters 
During the course of this investigation, the following matter was identified which should be 


brought to the institution’s attention. 
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While this complaint did not concern the improper disclosure of personal information by 
facsimile, we noticed that the Board had used a facsimile machine to transmit sensitive personal 
information. We reminded the Board of our faxing guidelines and enclosed, with our draft 
report, a copy of the following documents: "Guidelines on Facsimile Transmission Security, 
June 1989" and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990". 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The Board’s disclosure of the complainant’s personal information to its solicitor was in 


accordance with section 32(c) of the Act. 
e We found no evidence that the Board had disclosed the evaluation to any staff members. 


° The Board’s solicitor’s disclosure to the complainant’s lawyer was in accordance with 
section 32(c) of the Act. 


Original signed by: May 17, 1994 
Susan Anthistle Date 


Compliance Review Officer 


KKK 
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An institution shall not disclose personal information in its custody or under its control 


except, 
(a) 
(b) 


(c) 


(d) 


(f) 


(g) 


(h) 


G) 


APPENDIX A 


in accordance with Part I; 


if the person to whom the information relates has identified that 
information in particular and consented to its disclosure; 


for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


if the disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and if the 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or treaty; 


if disclosure is by a law enforcement institution, 

(i) to a law enforcement agency in a foreign country under an 
arrangement, a written agreement or treaty or legislative authority, 
or 

(ii) to another law enforcement agency in Canada; 

if disclosure is to an institution or a law enforcement agency in Canada to 
aid an investigation undertaken with a view to a law enforcement 
proceeding or from which a law enforcement proceeding is likely to 
result; 

in compelling circumstances affecting the health or safety of an individual 
if upon disclosure notification is mailed to the last known address of the 


individual to whom the information relates; 


in compassionate circumstances, to facilitate contact with the next of kin 
or a friend of an individual who is injured, ill or deceased; 


to the Minister 
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to the Information and Privacy Commissioner; 


to the Government of Canada of the Government of Ontario in order to 
facilitate the auditing of shared cost programs. 


[IPC Investigation 194-005M/May 17, 1994] 


a” 


Information can riv acy 
Commissioner/Ontario 
Commissaire a l'information 
et a la protection de la vie privée/Ontario 


S (9 


INVESTIGATION REPORT 


) | INVESTIGATION 194-005P 


A COMMUNITY COLLEGE 


~» 80 Bloor Street West, 80, rue Bloor ouest 416-326-3333 
koh Suite 1700, Bureau 1700 1-800-387-0073 
Toronto, Ontario Toronto (Ontario) Fax/Téléc: 416-325-9195 


M5S 2V1 M5S 2V1 TTY/TDD: 416-325-7539 


“ 
7 Ge 


lal aie 7 : 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a community college (the 
College). 


The complainant, an employee of the College, was concerned about the collection and retention 
of records containing personal information about his job performance at the College, including 


a petition signed by co-workers, two cautionary letters from the employer, and a psychiatric 
report. 


The complainant advised that a clause in the collective agreement between the College and the 
union provided for removal of personal records after one year, however, his records had been 
retained on file for over two years, and the College would not agree to dispose of them. 

The complainant was of the view that the College’s collection and retention of his records was 
in contravention of the Freedom of Information and Protection of Privacy Act (the Act). 


Further, the complainant felt that the records were false and misleading, with groundless 
accusations about his job performance and attitude. 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information contained in the records "personal information" as defined 
in section 2(1) of the Act? If yes, 


(B) Did the College collect the personal information in the records in accordance with 
section 38(2) of the Act? 


(C) Did the College retain the personal information in the records in accordance with 
section 40(1) of the Act? 
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Issue A: Was the information contained in the records "personal information" as 
defined in section 2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an_ identifiable 
individual, including, 


(a) information relating to the race, national or ethnic origin, colour, 
religion, age, sex, sexual orientation or marital or family status of 
the individual, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved, 


(g) the views or opinions of another individual about the individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


We reviewed the records at issue. They included a petition signed by co-workers alleging 
hostile and threatening behaviour, two cautionary letters from the College, and a psychiatric 
report. The records contained the complainant’s name, information about the complainant’s 
work and marital situation, his age, the views of the complainant’s co-workers about him, and 
personal information about the complainant’ s employment, psychological and educational history. 


It is our view that the information contained in the records met the requirements of paragraphs 
(a), (b), (g) and (h) of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information contained in the records was personal information as 
defined in section 2(1) of the Act. 
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Issue B: Did the College collect the personal information in the records in accordance 
with section 38(2) of the Act? 


The complainant was of the opinion that the College had been harassing him by collecting his 
personal records. He felt that the College had been trying to "shoot the messenger" rather than 
deal with broader problems within his department. 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The College stated that its collection of the complainant’s personal information in the records 
was necessary to the proper administration of a lawfully authorized activity. 


The College advised that it had provided a standard notice of collection to the complainant when 
he became a permanent employee. The written notice had informed him that a personnel file 
containing personal information collected directly from him, or indirectly about him, on matters 
such as “employment history, salary, performance and attendance, had been initiated under the 
authority of the Ministry of Colleges and Universities Act R.S.O. 1980, c.272, s.5; R.R.O. 
1980, Reg 640 for the purpose of various human resources planning and reporting activities...". 
(Now, R.S.O. 1990, c.M.19 s.5 and 1990, Reg 770). 


Section 5(1) of the Ministry of Colleges and Universities Act states: 


Subject to the approval of the Lieutenant Governor in Council, the Ministry may 
establish, name, maintain, conduct and govern colleges of applied arts and 
technology that offer programs of instruction in one or more fields of vocational, 
technological, general and recreational eduction and training, in day or evening 
courses and for full-time or part-time students. 


Section 5(1) of Regulation 770 states, in part, that a Board of Governors has "the power to 


appoint, classify, promote, suspend, transfer, reclassify or remove...administrative, teaching and 
non-teaching personnel...". 
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It is, therefore, our view that the College’s management of human resources was a lawfully 
authorized activity. 


The College stated that it had collected the complainant’s personal information in order to carry 
out its administrative duties in an appropriate manner. These duties included documenting and 
responding to the complainant’s co-workers’ concerns about his behaviour; dealing with a 
situation which interfered with the functioning of the department, and undertaking various 
supervisory and administrative activities related to the disciplinary procedures of the College. 

The personal information which was collected included the views of co-workers about the 
complainant’s behaviour, a psychiatric assessment about the complainant and his work situation, 
information about his job performance etc. 


In our view, the College’s collection of this personal information was necessary to the proper 
administration of a lawfully authorized activity, i.e. human resources management. Therefore, 
the College’s collection of the complainant’s personal information in the records was in 
accordance with section 38(2) of the Act. 


Conclusion: The College collected the complainant’s personal information in the 
records in accordance with section 38(2) of the Act. 


Issue C: Did the College retain the records in accordance with section 40(1) of the 
Act? 


Section 40(1) of the Act states: 


Personal information that has been used by an institution shall be retained after 
use by the institution for the period prescribed by regulation in order to ensure 
that the individual to whom it relates has a reasonable opportunity to obtain 
access to the personal information. 


Section 5(1) of Regulation 460 of the Act stipulates the length of time that personal information 
must be retained: 


Personal information that has been used by an institution shall be retained by the 


institution for at least one year after use unless the individual to whom the 
information relates consents to its earlier disposal. (emphasis added) 
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The College advised that while an employee may ordinarily request the removal of a disciplinary 
notice that has been in his or her personnel file for more than one year, under section 16.4 of 
the collective agreement, the removal of such notice is at the discretion of the College. 
However, because of the nature of its transactions with the complainant, the College felt it was 
necessary to retain the records. Section 16.4 of the collective agreement states: 


Each employee may, once each calendar year, request the removal of a 
disciplinary notice that has been in his/her official personnel file for more than 
one (1) year. The removal of such notice shall be at the discretion of the 
College. Such discretion shall not be exercised unreasonably. 


The College stated that it continued to have concerns about the complainant’s behaviour and 
conduct and the impact this had on the work environment. Human resource management was 
ongoing with respect to the measures the College had undertaken. Furthermore, the complainant 
was pursuing a grievance involving the issues raised by the records that contained his personal 
information. It appeared, therefore, that the College was still "using" the complainant’s personal 
information that it had collected. 


However, even if the College was no longer using this personal information, while an institution 
is required under the Act to retain personal information for a one year minimum period after its 
use, there is no maximum time limit. Therefore, it is our view that the College’s retention of 
the complainant’s records was not in contravention of the Act. 


Conclusion: The College retained the personal information in the records in accordance 
with section 40(1) of the Act and section 5(1) of Regulation 460 made 
under the Act. 


Other Matters 


The complainant stated that the records contained false and misleading accusations about his job 
performance and attitude. The College advised us that they had informed the complainant of 
his right to make corrections to his personal information, as provided for under section 47 of 
the Act. We also informed the complainant of this right. 
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SUMMARY OF CONCLUSIONS 


e The information contained in the records was personal information as defined in section 
2(1) of the Act. 


e The College’s collection of the personal information in the records was in accordance 
with section 38(2) of the Act. 


e The College’s retention of the personal information in the records was in accordance with 
section 40(1) of the Act and section 5(1) of Regulation 460 made under the Act. 


Original signed by: May 11, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named separate school 
board (the Board). 


The complainant had made a number of requests for access to information to the Board, under 


the Municipal Freedom of Information and Protection of Privacy Act (the Act). 


The complainant who had a keen interest in the public education system, and the operations of 
the Board, appeared as a member of a panel discussing the education system in a live television 
broadcast. A Trustee of the Board was also a panel member. During the televised debate, the 
Trustee indicated that the Board had expended substantial resources in dealing with the 
complainant’s access requests. 

The complainant was concerned that he had been identified by the Trustee as making access 
requests that drained the resources of the Board. The complainant stated that he might run as 
a candidate in a forthcoming municipal election and was concerned that he would be perceived 
as a trouble maker by the voting public. 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) — Was the personal information disclosed in accordance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information "personal information" as defined in section 2(1) of the 
Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 
(h) the individual’s name if it appears with other personal information 


relating to the individual or where the disclosure of the name 
would reveal other personal information about the individual; 
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The complainant provided us with a video tape of the televised debate. During the discussion, 
the Trustee referred to the complainant by name, stating that many thousands of dollars and 
much staff time had been spent in dealing with his access requests. 


The Board had records on file relating to the complainant’s access requests and containing 
information about the cost and time spent to process his complainants. It is, therefore, our view 
that the information in question met the definition of paragraph (h) of the definition of "personal 
information" in section 2(1) of the Act. 


Conclusion: The information was "personal information" as defined in section 2(1) of 
the Act. 


Issue B: Was the personal information disclosed in accordance with section 32 of the 
Act? 


Under the Act, an institution cannot disclose personal information in its custody or under its 
control except in the circumstances outlined in section 32. 


Section 32(b) of the Act states that: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(b) if the person to whom the information relates has identified that 
information in particular and consented: to its disclosure; 


The Board stated that it had relied on section 32(b) for its disclosure. The complainant had 
informed the media that he had obtained certain information about the Board through access 
requests he had made to the Board. Several newspaper articles had mentioned this. The 
complainant had also made representations to the legislature which had been recorded in 
"Hansard". In addition, the complainant had also made a public presentation to the Board in 
which he had disclosed information about his requests. The Board held that the Trustee had, 
therefore, disclosed information that was in the public domain, and that the complainant had 
clearly wished members of the public to know that he had been able to obtain records from the 
Board through access requests under the Act. 


We have examined the relevant newspaper articles, the relevant parts of "Hansard" and a copy 
of the complainant’s presentation to the Board. However, it is our view that the information that 
the complainant had himself disclosed to the media and to others was not the specific information 
that had been disclosed by the Trustee during the television broadcast. It is our view, that the 
complainant did not identify the personal information disclosed by the Trustee "in particular" 
nor did he consent to its disclosure. Therefore, the Board’s disclosure of the complainant’s 
personal information was not in accordance with section 32(b) of the Act. 
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We have also examined the other provisions of section 32 and are of the view that none were 
applicable to the Board’s disclosure of the complainant’s personal information. 


Conclusion: The complainant’s personal information was not disclosed in accordance 
with section 32 of the Act 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 

© The complainant’s personal information was not disclosed in accordance with section 32 
of the Act 

RECOMMENDATION 


During the course of this investigation, the Board informed us that they were preparing a 
memorandum providing guidance on the appropniate disclosures of personal information relating 
to access requests under the Act, which they proposed to send to all trustees and senior staff. 


It is our view that the issuance of this memorandum isan appropriate step to take to ensure 
compliance with the Act. We, therefore, recommend that the Board implement this step but to 
include in the memorandum’s distribution not only trustees and senior staff but any other 
employee who may be involved in the processing of an access request. 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: July 20, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ontario Civilian 
Commission on Police Services (the Commission) of the Ministry of the Solicitor General and 
Correctional Services (the Ministry). The Commission is a quasi-judicial authority which 
adjudicates appeals, hearings and inquiries under the Police Services Act. 


The complainant had written to the Commission indicating that she believed that there should 
be an investigation into the adequacy, efficiency and competency of a named Police Service and 
Police Services Board (the Police). 


An Advisor from the Commission had responded to the complainant’s letter of complaint by 
stating: 


I understand that the Policing Services Division of the Ministry of the Solicitor 
General is aware of the circumstances in (the named town) and for that reason 
and that there is no evidence before the Ontario Civilian Commission on Police 
Services we do not have any jurisdiction to become involved at this stage. 


Thus, the Commission did not investigate the complainant’s complaint. However, the 
Commission did investigate a similar complaint concerning the Police which had been filed by 
another member of the community. 


The complainant stated that when the aforementioned Advisor was investigating the similar 
complaint, he had disclosed to the person who had filed the similar complaint and to another 
- member of the community, the fact that the complainant had also filed a complaint against the 

Police. She further stated that her identity as a complainant had also been disclosed to the local 
Police Chief. 


The complainant maintained that she had not consented to her name being released in this 
manner, and was concerned that this disclosure had contravened the Freedom of Information and 


Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) | Was the personal information disclosed to the two individuals in compliance with 
section 42 of the Act? 


(C) | Was the personal information disclosed to the Police Chief in compliance with 
section 42 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


The information in question was the complainant’s name and the fact that she had complained 
about the Police to the Commission. In our view, this information met the requirements of 
paragraph (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information, as defined in 
section 2(1) of the Act. 


Issue B: Was the personal information disclosed to the two individuals in Ss 
with section 42 of the Act? 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 42. 


The Ministry submitted that during the Commission’s investigation into the similar complaint, 
the Advisor "may have mentioned" the complainant’s name to the two individuals. The Ministry 
added that the Advisor "... cannot say with certainty that he did mention her name, cannot recall 
when this may have occurred and really cannot recall having done so." 


The Ministry further submitted that if the Advisor had in fact disclosed the complainant’s name 
"... lt was during the course of a law enforcement investigation and disclosure was for a 


consistent purpose.” 


We contacted the two individuals. They stated that the Advisor had contacted them, and had 
identified the complainant, by name, as having complained about the Police. 


We also spoke directly with the Advisor. He stated that although he did not specifically recall 
disclosing the complainant’s name to the two individuals, he probably did. 


Based on the above, it is our view that in all likelihood, the Advisor disclosed the complainant’s 
personal information to the two individuals. 


Although not specifically referred to in its original representations, the Ministry made a number 
of submissions which were of a nature and kind that would relate to section 42 of the Act. 
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Therefore, in our draft report, we examined whether this disclosure was in compliance with 
section 42 of the Act; in particular, sections 42(c) and (g) of the Act. 


In its response to our draft report, the Ministry stated that it had relied on section 42(c) and not 
on section 42(g) for the disclosure. The Ministry submitted in part that the disclosure of the 
complainant’s name was for a purpose consistent with law enforcement. We have considered 
the Ministry’s representations and in our view, they appear to relate to both sections 42(c) and 
42(g) of the Act; therefore, the application of both sections are discussed in this report. 


Section 42(c) 


Section 42(c) of the Act states that an institution shall not disclose personal information in its 
custody or under its control except "for the purpose for which it was obtained or compiled or 
for a consistent purpose". 


The Ministry stated that when the complainant wrote to the Commission about the Police, the 
Advisor had already been assigned to investigate an identical complaint. The Ministry stated 
that, at that time, the Commission had received three complaints regarding the Police. 


The Ministry added that when the Commission receives a complaint about a police service 
board, the affected police services board and/or police service is advised of the number of 
complaints, the nature of the complaints, and the identity of the complainants. The Ministry 
further stated that since the complainant’s complaint was virtually identical to the complaint 
already being investigated, there had been no need to initiate another investigation. 


The Ministry further stated that all relevant aspects must be taken into consideration during the 
course of an investigation, and that all relevant aspects would include similar allegations. It 
added that "The discussion of all relevant factors during a law enforcement investigation would 
be for a consistent purpose, the consistent purpose being the law enforcement investigation." 


The Ministry also advised that the complainant had not specifically noted on her complaint that 
it was made in confidence, and thus she would have reasonably expected the disclosure of her 
personal information. 


It is our view that the Ministry (i.e., the Commission) would have obtained or compiled the 
complainant’s personal information for the purpose of dealing with her complaint. Since the 
Commission informed her that it did not have "any jurisdiction to become involved at this 
stage", and did not initiate an investigation into her complaint, it cannot be said that the 
complainant’s identity was disclosed to the two individuals for the purpose for which it had been 
obtained or complied, namely, dealing with her complaint. 


It is also our view that the disclosure was not for a "consistent purpose". 
Section 43 of the Act provides that: 
Where personal information has been collected directly from the individual to 


whom the information relates, the purpose of a use or disclosure of that 
information is a consistent purpose under clauses 41(b) and 42(c) only if the 
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individual might reasonably have expected such a use or disclosure. 


It is our view that since she had been informed that the Commission had no jurisdiction at the 
time and since the Commission did not initiate an investigation into her complaint, the 
complainant’s reasonable expectation was likely that her involvement was over. 


Further, the complainant’s concerns were of the most general nature, unrelated to any specific 
incident or person. There appeared to be no reason why her identity would have been a relevant 
factor or be of assistance in the investigation of someone else’s complaint. In our view, the 
complainant could not have reasonably expected that her name would be disclosed to the two 
other individuals. 


It is our view that the Ministry’s disclosure of the complainant’s personal information to the two 
individuals was not in compliance with section 42(c) of the Act. 


Section 42(g) 


As previously mentioned, the Ministry also submitted that if the Advisor had disclosed the 
complainant’s name, "it was during the course of a law enforcement investigation ...". 


Section 42(g) of the Act states that an institution shall not disclose personal information in its 
custody or under its control except, 


where disclosure is to an institution or a law enforcement agency in Canada to aid 
an investigation undertaken with a view to a law enforcement proceeding or from 
which a law enforcement proceeding is likely to result; 


In order for section 42(g) of the Act to apply, the disclosure must be to an institution or a law 
enforcement agency in Canada. In this case, the disclosure was to two individuals. Therefore, 
the Ministry cannot rely on section 42(g) of the Act for the disclosure of the complainant’s 
personal information to the two individuals. 


We reviewed the remaining provisions of section 42 and found that none applied to the 
Ministry’s disclosure of the complainant’s personal information to the two individuals. 


Conclusion: The disclosure of the personal information to the two individuals was not 
in compliance with section 42 of the Act. 


Issue C: Was the personal information disclosed to the Police Chief in compliance with 
section 42 of the Act? 


As previously mentioned, the Ministry stated that when complaints are received by the 
Commission, the affected police services board and/or police service is advised of the number 
of complaints, the nature of the complaints, and the identity of the complainants. The Ministry 
also stated that the Commission had received three complaints, and that although only one of the 
complaints was being investigated, the Police would have been made aware of the other two 
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complaints, one of them being the complainant’s. 


We asked the Advisor if he had disclosed the complainant’s identity to the Police Chief. He 
stated that although he did not specifically recall disclosing this information, he probably did. 


We also spoke to the Chief. He stated that he could not recall if the Advisor had identified the 
complainant as having made a complaint. The Chief referred back to his notes of June 16, 
1993, which he made during a meeting with the Advisor. He stated that his notes made no 
mention of the complainant having filed a complaint. 


The Chief, however, did recall being informed by another Ministry employee that the 
Commission had received three letters. The Chief stated that this employee identified the three 
complainants: a local businessman, the individual whose complaint the Commission had 
investigated, and the complainant. 


Based on the above information, it would be reasonable to conclude that the Ministry disclosed 
the complainant’s personal information to the Police Chief. 


Although the Ministry did not specifically indicate, in its original representations, that it was 
relying on section 42 of the Act for the disclosure to the Police Chief, its submissions appear 
to be related to this section of the Act. We, therefore, examined whether the disclosure was in 
compliance with section 42 of the Act; specifically, whether it was in compliance with sections 
42(c) and (g) of the Act. 


Section 42(c) 


As previously stated, section 42(c) of the Act permits the disclosure of personal information "for 
the purpose for which it was obtained or compiled or for a consistent purpose”. 


The Ministry submitted that "... in order for individuals, boards etc. to adequately and 
accurately respond to complaints or allegations and also to fairly determine their own rights, they 
have to be aware of the nature of the complaint and the person making the allegations or 
complaints." 


Under Issue B, we stated that it was our view that the Ministry (i.e., the Commission) would 
have obtained or compiled the complainant’s personal information for the purpose of dealing 
with her complaint. Since the Commission informed her that it did not have "any jurisdiction 
to become involved at this stage", and accordingly did not initiate an investigation into her 
complaint, it cannot be said that her identity as a complainant was disclosed for the purpose for 
which it had been obtained or compiled. | 


There may be instances in which such a disclosure to the Police Chief might have been justified, 
for example, where the disclosure was necessary to determine whether the complaint merited an 
investigation. In the circumstances of this complaint, however, we have not been persuaded that 
this was the case. 
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It is also our view that the disclosure was not for a “consistent purpose". As previously 
indicated, section 43 of the Act provides that a disclosure is for consistent purpose only if the 
individual to whom the information relates "might have reasonably expected" such a disclosure. 


It is our view that since no investigation into her complaint had taken place, the complainant 
could not have reasonably expected that her name or her complaint would be disclosed to the 
Police Chief. Although the Commission was investigating similar concerns, it did not inform 
the complainant of the other investigation. 


It is our view, therefore, that the disclosure to the Police Chief was not in compliance with 
section 42(c) of the Act. 


Section 42(g) 


The Ministry stated that investigations of this nature are conducted under section 25(1) of the 
Police Services Act (the PSA). It further stated that the investigation conducted by the Advisor 
fell within the definition of “law enforcement" in section 2(1) of the Act, and that investigations 
of this nature could lead to proceedings in a court or tribunal and penalties or sanctions may be 
imposed in accordance with sections 25(4), (5) and (6) of the PSA. 


The Ministry further stated that "all relevant aspects must be taken into consideration during the 
course of any law enforcement investigation. If all factors and aspects are not considered just 
and fair conclusions or recommendations cannot be ‘made. All relevant aspects would include 
similar allegations”. 


Given the Ministry’s submission, we examined section 42(g) of the Act with respect to this 
disclosure. As previously stated, this section permits disclosure to “an institution or a law 
enforcement agency in Canada to aid an investigation undertaken with a view to a law 
enforcement proceeding or from which a law enforcement proceeding is likely to result." 


For section 42(g) to apply, the disclosure must be in aid of the investigation undertaken. Since 
the Commission did not initiate an investigation into the complainant’s complaint, it is our view 
that disclosure of her name would not have aided an investigation into her complaint, because 
no investigation into it took place. 


It is also our view that disclosing the complainant’s identity would not have aided the 
investigation into the other individual’s complaint, even though the complaints were similar. 
The complainant’s concerns were of the most general nature, unrelated to any specific incident 
or person. It is difficult to see how her identity could have been of assistance in formulating 
a response in the investigation of someone else’s complaint. 


It is, thus, our view that the disclosure of the complainant’s personal information, in the 
circumstances of this complaint, would not have aided the Ministry’s (i.e., the Commission’s) 
investigation, and thus was not in compliance with section 42(g) of the Act. 


We reviewed the remaining provisions of section 42 and found that none applied to the 
disclosure of the complainant’s personal information to the Police Chief. 
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Conclusion: The disclosure of the personal information to the Police Chief was not in 
compliance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information, as defined in section 2(1) of the 
Act. 
e The disclosure of the personal information to the two individuals was not in compliance 


with section 42 of the Act. 


e The disclosure of the personal information to the Police Chief was not in compliance 
with section 42 of the Act. 


RECOMMENDATION 


The Ministry should take steps to ensure that personal information is not disclosed, except where 
the disclosure is in compliance with section 42 of the Act. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed By: | November 30, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Northern 
Development and Mines (the Ministry). 


In 1984, the complainant acquired a parcel of land that held mining rights granted under the 
Mining Act. In 1991, the Mining Act was amended, providing for fee increases and changes 
to the mining land tax (previously called acreage tax) rate. The complainant believed that the 
amendments would lead to the confiscation of the properties of owners who could not pay the 
higher taxes to maintain their mining nights. 


On May 3, 1993, the complainant wrote to all but three provincial members of parliament 
(MPPs) soliciting their support for a private member’s bill which he felt would correct "an 
injustice inadvertently caused by the recent changes to the Mining Act and Regulations." 


On May 25, 1993, the Minister of Northern Development and Mines (the Minister), one of the 
three MPPs who had not received the letter from the complainant, wrote to the Liberal MPP 
who was his party’s "mines critic." In her correspondence, the Minister referred to the 
complainant’s letter and discussed his particular situation with respect to his property and the 
mining land taxes. 


On January 10, 1994, the complainant wrote again to those MPPs from whom he had not 
received a reply to his earlier letter. At this time, a copy of the Minister’s letter was forwarded 
to the complainant from the Liberal MPP via another MPP -- the member who had planned to 
introduce the private member’s bill. 


The complainant believed that the Minister’s letter to the Liberal MPP was an "attempt to 
discredit me and my position" and to "distract attention from the issue I have raised." The 
complainant stated that in his letter to MPPs, he "was careful to focus on the inequity caused 
by the Act" and not the issue "related to the fact that the Ministry had previously illegally levied 
a tax on my property." The complainant, therefore, believed that the Minister’s letter disclosing 
information about him, his property and its mining potential, and the provincial mining taxes he 
had paid, was contrary to the provisions of the Freedom of Information and Protection of 
Privacy Act (the Act). 
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Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question, "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Ministry disclose the complainant’s personal information in compliance 
with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question, "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information" in part, as: 
recorded information about an identifiable individual, including 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the 
individual has been involved; . 


(h) the individual’s name where it appears with other personal 
information relating to the individual... 
(emphasis added) 


The Minister’s letter to the MPP included the following information: 


The name of the complainant; when he acquired his parcel of land and what it consisted of; how 
much he paid in acreage tax and at what time; that he was the only holder of patented mining 
lands who had continually expressed concerns about the increases in the mining land taxes; the 
complainant’s views that this was an attempt by the province to confiscate his property; that if 
he chose not to pay mining land taxes on his property, he would be able to continue to enjoy the 
use of his lands; that he had not engaged in any mining activity on his property nor had he 
expressed plans to do so; his views that he should continue to maintain the mining rights to his 
property but be exempt from the new mining tax rate; that he did not want the mining or mineral 
exploration sector to be allowed on his land if he relinquished his mineral rights and continued 
to hold the surface rights; that the Minister and her predecessor had had contacts with him and 
that several ministry staff had spent many hours with him on this issue; that he might not want 
to pay increased taxes for a right that in the past was inexpensive to hold; and that he had paid 
mining taxes in the past and had only objected strenuously since 1991 when the increases were 
enacted. 
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It is our view that the above information met the requirements of either paragraphs (b) or (h) 
of the definition of personal information in section 2(1) of the Act. 


In its submissions to our draft report, the Ministry said that it was not factually correct to say 
that the Minister’s letter had disclosed how much the complainant had paid in acreage taxes, 
since no amount had actually been given. However, the letter gave the number of hectares for 
which the complainant had paid taxes, at a specific rate per year, for a certain number of years. 
Thus, the acreage taxes that the complainant had paid could easily be determined from this 
information. In our view, this constituted a disclosure of how much the complainant had paid 
in acreage taxes. 


Conclusion: The information was "personal information" as defined in section 2(1) of 
the Act. 


Issue B: Did the Ministry disclose the personal information in compliance with section 
42 of the Act? 


Under the Act, an institution cannot disclose personal information in its custody or under its 
control except in the circumstances outlined in section 42. 


The Ministry submitted that the complainant had, through disclosures in newspaper articles, 
discussions with an investigative journalist and in writing to the MPPs, "impliedly consented to 
the disclosure" of his personal information. 


Section 42(b) of the Act states that an institution shall not disclose personal information in its 
custody or under its control except: 


where the person to whom the information relates has identified 
that information in particular and consented to its disclosure; 


Two newspaper articles, one of which was written by the complainant, expressed his concern 
that the amended legislation would lead to the confiscation of properties such as his. In the 
background appendix to his letter to the MPPs, the complainant mentioned that he had 
corresponded with the Minister’s staff about the legislation, as well as pointing out that "the tax 
is now extended to other properties such as mine" and that he did not support the "effective theft 
of my property by mining firms." 


However, the complainant contended that in his letter, he had been "careful to focus only on the 
inequity caused by the Act." He did not introduce any information relating to the other issue 
of the Ministry’s "improper administration" with respect to the previous levy of taxes on his 
property. The complainant further advised that the Mining Act "deals with the policy issues and 
the intent of the legislation and my letter to M.P.P.s restricted itself to this issue;" the 
information disclosed in the Minister’s letter "was not directly relevant." 
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Upon reviewing this material, we concluded that the Ministry’s disclosure was not in compliance 
with section 42(b) of the Act. However, in reaching this conclusion, we recognize that the 
Ministry may have believed that as a result of the complainant’s publicly-declared views in this 
area, not only through newspaper articles but also in letters written to MPPs, the Ministry would 
be permitted to discuss the matter publicly. But the Ministry disclosed a considerable amount 
of additional information -- the complainant’s personal information which the Ministry had in 
its possession as a result of his personal dealings with the Ministry. 


While parts of the personal information disclosed by the Ministry were similar to the information 
disclosed in the complainant’s letter to the MPPs and the newspaper articles, it is our view that 
it could not be said that the complainant had identified the personal information contained in the 
Minister’s letter "in particular", nor "consented" to its disclosure. Thus, it is our view that the 
Ministry’s disclosure was not in compliance with section 42(b) of the Act. 


The Ministry also submitted that the disclosure might "reasonably have been expected" by the 
complainant so as "to bring it within the phrase ‘consistent purpose’ in clause 42(c) of the Act." 


Section 42(c) of the Act permits the disclosure of personal information: 


for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


In other words, the disclosure must either be for the same purpose for which the personal 
information was collected or for a purpose that was consistent with that purpose. Section 43 of 
the Act further provides that: © 


Where personal information has been collected directly from the 
individual to whom the information relates, the purpose of a use 
or disclosure of that information is a consistent purpose under 
clauses 41(b) and 42(c) only if the individual might reasonably 
have expected such a use or disclosure. 


It is our view that one of the purposes for which the Ministry had compiled or obtained the 
complainant’s personal information would have been to maintain administrative 
records/correspondence files about the complainant and his property, which would include 
information about when he had acquired his property, the acreage taxes he had paid prior to 
1991, his mining nights, etc. 


The Ministry stated that the Minister’s letter was not written in response to any particular 
inquiry from the Liberal MPP, and no specific purpose was provided for the disclosure of the 
complainant’s personal information. However, in her letter, the Minister explained that she was 
aware that the complainant had sent the Liberal MPP a letter soliciting his support for the private 
member’s bill and that she "would like to take this opportunity to bring you up to date on the 
details of our mining tax and the issue that is of concern to (the named complainant)." 
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The Minister’s letter, however, included not only the details of the mining tax and the general 
issue of the intent of the legislation which was the object of the complainant’s concern, but also 
gave specific information about the complainant and his property: when he had purchased it, 
whether he had engaged in any mining activities; that he did not want the mining or mineral 
exploration sector to be allowed on his land, etc. (See details given under issue A). 


Although the complainant had disclosed some personal information in his letter that was similar 
to the personal information disclosed by the Minister, as previously noted, the complainant 
contended that the personal information disclosed by the Minister was about a separate matter 
which was not relevant to the issue he had raised, and which he had taken care not to introduce 
in his letter to the MPPs. 


Having carefully considered both the Ministry’s submissions and the complainant’s submissions, 
it is our view that the complainant could not have "reasonably expected" that the specific details 
collected by the Ministry for its files about him, his property, and his experiences with the 
Ministry, would subsequently be disclosed in this manner (through the Minister’s letter to the 
MPP). 


Therefore, it is our view that the Ministry’s disclosure of the complainant’s personal information 
for the purpose of updating the Liberal MPP on the mining land tax and the complainant’s 
general concern could not be said to have been for a "consistent purpose." Thus, the Ministry’s 
disclosure was not in compliance with section 42(c) of the Act. 


We have also examined the other provisions of section 42 of the Act and found that none applied 
in the circumstances of this case. 


Conclusion: The disclosure of the complainant’s personal information was not in 
compliance with section 42 of the Act. 


OTHER MATTERS 


In its submissions to our draft report, the Ministry stated that while we were correct in saying 
that the Minister’s letter was not written in response to the Liberal MPP, it was, however, 
written in reply to inquiries and requests from numerous MPPs seeking information about the 
same subject matter. However, no evidence in support of the existence of such inquiries was 
provided to us. In any event, this information would have had no impact on our conclusion 
regarding the unauthorized disclosure of the complainant’s personal information. 


In its submissions, the Ministry also raised the issue of whether section 37 of the Act was 
applicable to the personal information disclosed in this case since, "it deals with the personal 
information in records at a land registry office (ownership of land, date of acquisition, size of 
parcel) or in news paper (sic) articles which were and continue to be available to the public 
through many public libraries ..." If section 37 applied, then the privacy protection afforded 
by Part III of the Act would not be applicable. 
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In his submissions, the complainant also addressed this matter. He stated that "the information 
was available to no one outside of the Ministry." With respect to the taxes he had paid, the 
complainant stated that, in his view, "it would be impossible for an outsider to find out that I 
had paid a tax prior to 1991 or even to suspect that I had paid a tax at that time, unless they 
were told by the Ministry. Anyone who set out to find out if I was liable for such a tax ... 
would determine that there was no tax applicable on the property ... The land title information 
in the land registry office would provide no information on a superficial examination ... Only 
the Ministry knew that the tax had been levied." 


Section 37 of the Act states that: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


It is our view that, if applicable, section 37 excludes personal information from the privacy 
provisions of Part III of the Act only if the information in question is held by the institution 
maintaining it for the express purpose of creating a record available to the general public. 
Other institutions cannot claim the benefit of the exclusion for the same personal information 
unless they, too, maintain the information for the purpose of making it available to the general 
public. In our view, this interpretation is not only reasonable, but also in keeping with one of 
the fundamental goals of the Act, namely "to protect the privacy of individuals with respect to 
personal information about themselves held by institutions." In the circumstances of this case, 
it cannot be said that the Ministry was maintaining the complainant’s personal information (that 
was later disclosed in the Minister’s letter) specifically for the purpose of creating a record 
available to the general public. Accordingly, section 37 of the Act did not apply. 


However, even if a broader interpretation of section 37 were adopted, it would still not be 
applicable to much of the personal information disclosed in this case, such as, the information 
about the complainant not having engaged in any mining activity on his property, or any other 
information about the complainant’s personal dealings with the Ministry. 


Conclusion: Section 37 of the Act was not applicable. 


CONCLUSIONS 
The information was "personal information" as defined in section 2(1) of the Act. 
e The disclosure of the complainant’s personal information was not in compliance with 


section 42 of the Act. 


e Section 37 of the Act was not applicable. 
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RECOMMENDATION 


In our draft report, we recommended that the Ministry take appropriate steps such as to remind 
all officials and staff of the requirements of the Act, in order to ensure that personal information 
is not disclosed except in compliance with the Act. 


The Ministry has responded that it accepts this recommendation and has taken the necessary 
steps towards its implementation. Within six months of receiving this report, the Ministry 
should provide the Office of the Information and Privacy Commissioner with proof of 
compliance with the above recommendation. 


Original signed by September 13, 1994 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 


POSTSCRIPT 


In his submissions to the draft report, the complainant requested that an additional 
recommendation be made to require that, "the Ministry release to me copies of all documents 
within the Ministry and sent from the Ministry ... along with an identification of all recipients 
of the correspondence or communications." The Act provides the complainant with the means 
to make an access request to the Ministry for the desired information. The Ministry may, 
however, wish to provide the complainant with the information he seeks, in the absence of a 
formal access request, ensuring, however, that any release of information is in compliance with 
the Act. 


KK KK 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a District Health Council 
(the Council). 


The complainant was the Executive Director of the Council from 1989 until October 1993. In 
October 1993, the complainant left this position for a secondment with the Ministry of Health 
(the Ministry). The complainant maintained that, before she took up the new position with the 
Ministry, numerous disclosures of her personal information were made by the Council to the 
Ministry; to a local newspaper; to Members.of a Council committee; and to the public. These 
disclosures were related to her employment at the Council and her performance as Executive 
Director, and included information that she had allegedly been terminated and had been given 
a number of alternatives, one of which was the secondment at the Ministry. 


She also complained that there had been a disclosure by the Council’s acting Chair to the 
Ministry that she was seeking access to information under the Freedom of Information and 
Protection of Pmvacy Act (the Act). 


The complainant stated that these disclosures were contrary to section 42 of the Act. 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Council disclose the complainant’s personal information to the Ministry, 
and if so, was the disclosure in compliance with section 42 of the Act? 


(C) Did the Council disclose the complainant’s personal information to a local 
newspaper, and if so, was the disclosure in compliance with section 42 of the 
Act? 


(D) Did the Council disclose the complainant’s personal information during two 
Committee meetings and in the minutes of these meetings? If so, were the 
disclosures in compliance with section 42 of the Act? 


(E) Was the Council’s disclosure to the public of the complainant’s personal 
information, contained in two letters of resignation from two Council Members, 
in compliance with section 42 of the Act? 


(F) Did the Council’s acting Chair disclose to the Ministry that the complainant was 


seeking access to information under the Act, and if so, was the disclosure in 
compliance with section 42 of the Act? 
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Oh: 


(G) Was the Council’s disclosure of the complainant’s personal information to a 
Ministry employee in compliance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) states, in part: 


"personal information” means recorded information about an identifiable 
individual, including, 


(g) the views or opinions of another individual about the 
individual, and 


(h) the individual’s name where it appears with other personal 
information relating to the individual... 


The information in each of the disclosures in question related to the complainant’s employment 
at the Council and her performance as Executive Director, including information about her 
termination of employment, severance pay, and secondment, and the views and opinions of two 
other Council Members about the complainant. 


In our view, this information met the requirements of paragraphs (g) and (h) in section 2(1) of 
the Act. 


Also at issue was the complainant’s name together with the fact that she had made an access 
request under the Act. As we have previously found in other compliance investigations and 
orders, this information met the requirements of paragraph (h) in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Did the Council disclose the complainant’s personal information to the 
Ministry, and if so, was the disclosure in compliance with section 42 of the 
Act? 


The complainant stated that the Council’s Executive Members disclosed her personal information 
to a branch of the Ministry. The complainant provided us with a confidential memorandum 
addressed to the Council Members, dated October 1993, in which the Chair of the Council stated 
that a certain decision had been made after consultation with the Ministry. The complainant 
stated that the information disclosed to the Ministry during this “consultation” was her 
employment and performance related personal information. 


The Council informed us that there had been a discussion between the Chair and the Ministry, 


where the possible termination of the complainant’s employment, the need for severance pay, 
and the possibility of a secondment with the Ministry had been discussed. The Council advised 
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us that this discussion took place because any decision involving the possible termination of an 
employee and the payment of severance pay, required consultation with the funding agency, 
which, in this case, was the Ministry. The Council also discussed the matter with the Ministry 
in an attempt to provide the complainant with an alternative to the termination of her 
employment, (i.e. a possible secondment with the Ministry). 


However, the Council stated that no personal information had been provided relating to the 
complainant, and therefore, there had been no disclosure of the complainant’s personal 
information. 


As we have previously stated, information about the complainant’s termination, severance pay, 
and secondment is personal information under the Act. Therefore, it is our view that, in its 
discussion with the Ministry, the Council disclosed the complainant’s personal information. 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 42 (For full text, see 
Appendix A). 


The Council submitted in its response to.our draft report that, had personal information been 
disclosed, it would have been disclosed in compliance with section 42(e) of the Act. Section 
42(e) states that an institution shall not disclose personal information in its custody or under its 
control except "for the purpose of complying with an Act of the Legislature or an Act of 
Parliament or a treaty, agreement or arrangement thereunder". 


The Council stated that the information in question was disclosed to comply with the duties of 
the Council as provided in an Order-In-Council which requires that the Council advise the 
Minister of Health on the planning and co-ordination of health services in its designated area. 
The Council further stated that the co-ordination of health services is accomplished in part by 
the work of the Executive Director. Therefore, any decision to terminate the Executive Director 
affects the co-ordination of health services. 


It is our view that the word “complying” in section 42(e) indicates that the requirement in 
question must be mandatory in nature. In other words, in order for section 42(e) to apply, the 
Order-In-Council must impose a duty on the Council to disclose the complainant’s personal 
information. It is our view that the Order-In-Council does not compel the Council to disclose 
such personal information. Therefore, in our view, section 42(e) of the Act does not apply in 
the circumstances of this case. ; 


Further, while the Ministry was the funding agency for the Council and special budget 
requirements may have been needed by the Council in order to pay severance to an employee, 
we are not persuaded that in the circumstances of this case, the funding relationship required the 
disclosure of the complainant’s specific personal information. It is also our view that had the 
Council wanted to arrange a secondment at the Ministry for the complainant, such an 
arrangement should have been made after the complainant had been made aware that she had 
been terminated and had provided her consent for her personal information to be disclosed to 
the Ministry for this purpose. 


We have examined the remaining disclosure provisions of section 42 of the Act. It is our view 
that the Council’s disclosure of the complainant’s personal information to the Ministry was not - 
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in compliance with section 42 of the Act. 


Conclusion: The Council’s disclosure of the complainant’s personal information to the 
Ministry was not in compliance with section 42 of the Act. 


Issue C: Did the Council disclose the complainant’s personal information to a local 
newspaper, and if so, was the disclosure in compliance with section 42 of the 
Act? 


The complainant stated that the Council had disclosed to a local newspaper that she had been "let 
go". The complainant was concerned that one of the Council Members may have intentionally 
disclosed her personal information even though they knew that they had a responsibility to keep 
this information confidential. | 


The newspaper article was published in November 1993, the day after a Council meeting had 
been held in which the minutes of a "special council meeting" had been discussed. At the 
"special council meeting" the complainant’s release as Executive Director had been discussed. 


The newspaper article stated that, 


The Executive director of the [named health council] has been "let go," a board 
member says. 


The director, who did not wish to be identified, confirmed last night that [the 
complainant] ... was "let go" last month. 


The Council stated that the newspaper article, for the most part, reiterated a news release which 
had been prepared by the complainant and which she had provided to the Council through her 
lawyer. The article consisted primarily of an interview with the complainant herself. With 
respect to the reference in the article to the "director" (who apparently did not wish to be 
identified), the Council stated that it did not know who or if a director had spoken to the 
newspaper. However, the Council stated that, from the beginning of the process, it had fully 
emphasized to all of its directors the importance of confidentiality. 


We contacted two former Council Members who had resigned as a result of the complainant’s 
departure from the Council. One of these Members advised us that he had not disclosed any 
information to the press regarding whether the complainant was "let go". However, the other 
Member stated that she had been contacted by the newspaper. 


This Member stated that the newspaper reporter had informed her that the complainant had been 
let go. The newspaper had requested that the Member confirm this information, which she did. 
She stated that the newspaper reporter was clearly aware that the complainant had been released 
from the Council, prior to the reporter’s contact with her. 


While it appears that a former Council Member confirmed to the newspaper that the complainant 
had been let go, it is unclear if this or another “board member" initially disclosed the 


‘information. Since only Council Members were aware at that time that the complainant had 
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allegedly been "let go", and had accepted a secondment with the Ministry, it is possible that the 
information in question was disclosed by a Council Member. However, based upon the available 
information, we were unable to establish conclusively if a Council Member had made such a 
disclosure. 


We have, however, examined the disclosure provisions of section 42 of the Act. It is our view 
that if a Council Member had disclosed the complainant’s personal information to the local 
newspaper, this disclosure would not have been in compliance with section 42. 


Conclusion: We were unable to determine if the Council disclosed the complainant’s 
personal information to the newspaper. 


Issue D: Did the Council disclose the complainant’s personal information during two 
Committee meetings and in the minutes of these meetings? If so, were these 
disclosures in compliance with section 42 of the Act? 


The complainant stated that certain Council Members disclosed her employment and performance 
related personal information during two separate meetings of one of the Council’s standing 
committees (the Committee). 


The minutes from the first Committee meeting, held on November 16, 1993, stated that the 
Council’s Interim Executive Director, appointed after the complainant’s departure, had attempted 
to clarify the situation regarding the complainant’s secondment. He stated that "when she was 
relieved of her duties, she was given a number of alternatives and she chose the Ministry 
secondment where she will continue to work in the mental health field". The minutes also noted 
that one Committee Member was concerned about the amount of money being spent by the 
Council to reach a "settlement" with the complainant. The complainant maintained that this 
confirmed that the Committee Member was aware that the secondment was not a secondment 
but rather a dismissal. 


The draft minutes for the second Committee meeting, which was an Extraordinary Committee 
meeting held on December 8, 1993, stated that the Council’s acting Chair and a Council 
Member had discussed the opinions of the Council and Executive Committee; that there had been 
performance related difficulties with the complainant, and that she had been released from her 
employment. 


The minutes suggested, therefore, that there had been a disclosure of the complainant’s personal 
information at the meeting. However, the Council submitted that "notes" had been taken at 
these meetings that were not "minutes" of these meetings. These notes had been prepared by 
a staff member who had been in attendance and were released before the Council had reviewed 
them. They had been circulated without the usual procedures being followed that would have 
been followed if they had been actual minutes, which would have included a review by the 
Council. 


The Council also stated that the notes were not accurate. It explained that during the November 
16, 1993 meeting, the Interim Executive Director had not disclosed that the complainant had 
been "relieved" of her duties, and that she had been given a number of alternatives before 
choosing the secondment. The Council also stated that during the December 8, 1993 meeting, 
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neither the acting Chair nor the Council Member had indicated that there had been performance 
related difficulties with the complainant and that she had been released from employment. Both 
Council Members had only indicated that the complainant had taken a secondment with the 
Ministry. 


The Council stated that because the notes were not formal minutes, and because it did not asa 
matter of procedure, review informal notes before they were distributed, it had not taken any 
steps to correct the notes. 


The Council maintained that Council Members did not disclose the information in question. We 
are, therefore, unable to determine conclusively if the complainant’s personal information was 
disclosed by the Council during the Committee meetings. 


We also examined the disclosure of the complainant’s personal information contained in the 
minutes for the Committee meetings when they were released to Committee Members. 


While ine Council maintained that the notes taken at the Committee meetings were not 
"minutes", the notes were titled and prepared as minutes by the Committee. It is our view that 
the notes could be considered to be minutes of the Committee meetings in question. 


Even though the Council maintained that the minutes were not correct, nevertheless, the minutes 
contained the personal information of the complainant and were released to the Committee 
Members. Therefore, while the Council Members might not have disclosed the complainant’s 
personal information at the Committee meetings, the complainant’s personal information 
appeared in the minutes for these Committee meetings when they were released. Thus, the 
complainant’s personal information was disclosed by the Council. 


We have examined the disclosure provisions of section 42 of the Act. It is our view that the 
Council’s disclosure of the complainant’s personal information as it appeared in the minutes of 
the Committee’s meetings, was not in compliance with section 42 of the Act. 


Conclusion: We were unable to determine conclusively that the complainant’s personal 
information was disclosed by the Council during the Committee meetings. 


The Council’s disclosure of the complainant’s personal information as 
contained in the minutes of the Committee’s meetings, was not in 
compliance with section 42 of the Act. 


Issue E: Was the Council’s disclosure to the public of the complainant’s personal 
information, contained in two letters of resignation from two Council 
Members, in compliance with section 42 of the Act? 


The complainant stated that the Council disclosed, to the public, her personal information 


contained in two letters of resignation from two Council Members. This included the opinions 
and views of the resigning Council Members about the complainant. The Council included the 
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letters in a package provided to the public and media before a Council meeting. The letters 
contained personal information relating to the complainant’s termination of her employment, and 
the personal opinions of the two Council Members about the complainant. Both letters were 
addressed to the Ministry and carbon copied to the Council and certain specific Council 
Members. One of the letters was carbon copied to two former Council Members and to the 
complainant. 


The Council acknowledged that the two letters of resignation were included in a package made 
available to the public prior to a Council meeting. The Council stated that since the first 
resignation letter was addressed to the Minister of Health (the Minister), and copied to the 
Council Members, the resigning Council Member could have expected the resignation to be a 
public matter and that the Council "had no ability not to make it a public matter”. 


It was the Council’s position that the Council Member who addressed the second letter to the 
Minister had also expected and required his letter of resignation to be made public. The Council 
was of the view that these letters had already been copied to a number of people and had been 
made public by the writers themselves. 


Section 42(c) states that an institution shall not disclose personal information in its custody or 
under its control except " for the purpose for which it was obtained or compiled or for a 
consistent purpose". Further, section 43 states: 


Where personal information has been collected directly from the individual to 
whom the information relates, the purpose of a use or disclosure of that 
information is a consistent purpose under clauses 41(b) and 42(c) only if the 
individual might reasonably have expected such a use or disclosure. 


Section 42(c) and 43 of the Act would apply only if the complainant might reasonably have 
expected the disclosure of the letters containing her personal information to the public and 
media. .Whether the resigning Council Members might reasonably have expected the disclosure 
of their letters is not a relevant factor. 


It is our view that the complainant would not reasonably have expected that her personal 
information, as contained in these letters, would be included in a package made available to the 
public prior to a Council meeting. Therefore, in our view, section 42(c) of the Act does not 
apply in these circumstances. 


In addition, it is our view that by addressing the letters to the Minister and carbon copying 
certain other individuals, the resigning Council Members did not make the letters "public". This - 
is discussed in more detail under "Other Matters”. 


We also examined the remaining provisions of section 42. It is our view that none applied to 


the disclosure to the public of the complainant’s personal information contained in the resignation 
letters. Therefore, the disclosure was not in compliance with the Act. . 
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Conclusion: The disclosure of the complainant’s personal information in the resignation 
letters was not in compliance with section 42 of the Act. 


Issue F: Did the Council’s acting Chair disclose to the Ministry that the complainant 
was seeking access to information under the Act, and if so, was the disclosure 
in compliance with section 42 of the Act? 


The complainant stated that the Council’s acting Chair disclosed to the Ministry that the 
complainant was seeking access to information under the Act. The complainant stated that this 
occurred on January 24, 1994, when the acting Chair responded by e-mail to the complainant 
about her request for access to information, and copied staff at a branch of the Ministry. 


The Council stated that a request for access to information made under the Act is not personal 
information. The Council also stated that the complainant had sent numerous requests by e-mail 
to the acting Chair and that, in this case, the complainant indicated that she was requesting 
information and wanted to avoid the "FOI". The Council maintained that, as a result, the acting 
Chair did not consider the complainant’s request to be a request for access to information under 
the Act. 


As we previously stated, the complainant’s name together with the fact that she had made an 
access request under the Act was personal information under the Act. The complainant’s e-mail 
to the acting Chair, dated January 24, 1994, identified the subject line of the e-mail as "FOIPPA 
Request". The responding e-mail from the acting Chair to the complainant, which was copied 
to the staff at the Ministry, identified the subject line of the e-mail as "FOI Request", and the 
first line of the e-mail read "Thank you for your memo regarding your request for information 
- under the FOIPPA." Therefore, in our view, by copying the Ministry in the responding e-mail, 
and identifying that the complainant was seeking access to information under the Act, the acting 
Chair disclosed the complainant’s personal information. 


We have examined the disclosure provisions of section 42 of the Act. It is our view that the 
disclosure to the Ministry that the complainant had made an access request was not in 
compliance with section 42 of the Act. 


Conclusion: The disclosure of the complainant’s personal information to the Ministry, 
i.e. that the complainant had made an access request, was not in 
compliance with section 42 of the Act. 


Issue G: Was the Council’s disclosure of the complainant’s personal information to a 
Ministry employee in compliance with section 42 of the Act? 


With her submissions on the draft report, the complainant provided a copy of a memorandum 
and notes written by the Council’s Chair at that time, to the individual who became the 
Council’s Interim Executive Director and to the individual who replaced the Chair as acting 
Chair. The memorandum stated that the notes had been written in the back of the Chair’s day- 
timer and that they had been discussed with an employee of the Ministry. The notes were 
related to the complainant’s work performance. The complainant believed that the disclosure 
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by the Chair of her personal information contained in the notes to the Ministry employee was 
contrary to the Act. 


We contacted the Ministry employee. She advised us that she did not recall any conversations 
with the Chair regarding the complainant. She also stated that she had been the official "contact 
person" at the Ministry for the Council from July 1990 to approximately February 1992, before 
the complainant’s termination in October 1993. 


In its representations on this issue, the Council stated that there had been a discussion between 
the Chair and the Ministry employee. However, the Ministry employee was the person to whom 
the Council looked with respect to details surrounding a contract it was seeking. The Council 
stated that the Chair had contacted the employee to discuss the problems that had developed with 
the contract and to confirm if the Ministry wished the Council to proceed on retaining a specific 
consultant (the consultant). The Council submitted that given that the Ministry was funding the 
Study associated with obtaining the contract and services of the consultant, it was reasonable to 
expect the Chair to consult with the Ministry. 


The Council also stated that the comments about the complainant’s performance recorded in the 
notes were not the Chair’s but had been passed on to her by the consultant. In our view, this 
is not relevant to the issue of disclosure by the Chair to the Ministry employee. 


We examined the Chair’s memorandum and-notes. The memorandum stated that "I also 
discussed these notes with...[the Ministry employee]". At the bottom of the notes was written 
“Call [the Ministry employee]". It is, therefore, our view that the information about the 
complainant’s performance recorded in the Chair’s notes in the day-timer was disclosed in whole 
or in part to the Ministry employee. It is also our view that this disclosure occurred prior to the 
complainant’s termination. 


We examined the provisions of section 42 of the Act. It is our view that none applied to the 
disclosure of the complainant’s performance related information to the Ministry employee. 


Conclusion: The disclosure of the complainant’s personal information to the Ministry 
employee was not in compliance with section 42 of the Act. 
OTHER MATTERS 
As indicated previously under Issue E, the Council submitted that the letters of resignation from 
two Council Members had already become public by virtue of being addressed to the Minister 
and carbon copied to other people. 


Section 37 of the Act states that: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


[IPC Investigation 194-023P/December 23, 1994] 


De 


In our recent investigations, we have held that section 37 of the Act applies only where the 
institution complained of is the institution that is maintaining the personal information for the 
purpose of creating a record available to the general public. It is our view that, while the 
Minister and the other individuals carbon copied on the letters were aware that the two Council 
Members had resigned, it cannot be said that the Council was maintaining the complainant’s 
personal information contained in these letters, which were later disclosed in the Council 
meeting, specifically for the purpose of creating a record available to the general public. It is, 
therefore, our view that section 37 of the Act did not apply. 


Further, it is our view that the Council did not need to include the resignation letters in the 
package made available prior to its meeting. The Council could have publicly noted the 
resignations without releasing the actual letters containing the complainant’s personal 
information. oe 


Conclusion: Section 37 of the Act was not applicable to the complainant’s personal 
information contained in the resignation letters. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information” as defined in section 2(1) of the 
Act. 
e The Council’s disclosure of the complainant’s personal information to the Ministry was 


not in compliance with section 42 of the Act. 


e We were unable to determine if the Council disclosed the complainant’s personal 
information to the newspaper. 


® We were unable to determine conclusively that the complainant’s personal information 
was disclosed by the Council during the Committee meetings. 


The Council’s disclosure of the complainant’s personal information as contained in the 
minutes of the Committee’s meetings, was not in compliance with section 42 of the Act. 


e The disclosure of the complainant’s personal information in the resignation letters was 
not in compliance with section 42 of the Act. 


e The disclosure of the complainant’s personal information to the Ministry, i.e. that the 
complainant had made an access request, was not in compliance with section 42 of the 
Act. 

e The disclosure of the complainant’s personal information to the Ministry employee was 


not in compliance with section 42 of the Act. 
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e Section 37 of the Act was not applicable to the complainant’s personal information 
contained in the resignation letters. 


RECOMMENDATION 


We recommend that the Council take steps to ensure that all Council Members and staff are 
aware of the disclosure provisions in the Act. For example, all Council Members, staff, and 
committee members who handle personal information should be reminded in writing of the 
limited circumstances under which the disclosure of personal information is permitted. Any 
newly appointed Council Members and staff should be similarly informed. 


Within six months of receiving this report, the Council should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed by: December 23, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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42. An institution shall not disclose personal information in its custody or under its control 
except, 


(a) in accordance with Part II; 


(b) where the person to whom the information relates has identified that information in 
particular and consented to its disclosure; 


(c) for the purpose for which it was obtained or compiled or for a consistent purpose; 


(d) where disclosure is made to an officer or employee of the institution who needs the 
record in the performance of his or her duties and where disclosure is necessary and 
proper in the discharge of the institution’s functions; 


(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament or 
a treaty, agreement or arrangement thereunder; 


(f) where disclosure is by a law enforcement institution, 


(i) toalaw enforcement.agency in a foreign country under an arrangement, a written 
agreement or treaty or legislative authority, or 


(ii) to another law enforcement agency in Canada; 


(g) where disclosure is to an institution or a law enforcement agency in Canada to aid an 
investigation undertaken with a view to a law enforcement proceeding or from which a 
law enforcement proceeding is likely to result; 


(h) in compelling circumstances affecting the health or safety of an individual if upon 
disclosure notification thereof is mailed to the last known address of the individual to 
whom the information relates; 


(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of 
an individual who is injured, ill or deceased; 


(j) to a member of the Legislative Assembly who has been authorized by a constituent to 
whom the information relates to make an inquiry on the constituent’s behalf or, where 
the constituent is incapacitated, has been authorized by the next of kin or legal 
representative of the constituent; 


(k) to a member of the bargaining agent who has been authorized by an employee to whom 
the information relates to make an inquiry on the employee’s behalf or, where the 
employee is incapacitated, has been authorized by the next-of-kin or legal representative 
of the employee; 


A-] 
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(1) to the responsible minister; 


(m) to the Information and Privacy Commissioner; and 


2 
(n) to the Government of Canada in order to facilitate the auditing of shared cost programs. 
> 
A-2 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Community 
and Social Services (the Ministry). 


The complainant is an employee of a facility operated by the Ministry. Another employee at 
the facility initiated a grievance proceeding against the Ministry, stating that administration and 
management had been discriminating against him and harassing him at his workplace. 


A hearing was held before the Grievance Settlement Board (the GSB). The complainant, who 
was not a party to the grievance, was subpoenaed by the griever to attend this hearing. At the 
GSB hearing, the first witness to testify on behalf of the griever was a representative of the 
union to which the griever belonged. 


During cross-examination, the witness was asked by the Ministry’s counsel (the Counsel) if the 
complainant had been convicted of mischief for a certain reason. The witness responded 
affirmatively. The Counsel had been advised of this information by management’s representative. 
At a subsequent GSB hearing regarding the same matter, the Counsel again asked a witness 
about the complainant’s criminal conviction. The witness confirmed that the complainant had 
been convicted. 


The complainant was concerned that the management representative, who was the Assistant 
Administrator at the facility where the complainant was employed, had accessed his personnel 
file prior to the GSB hearing, without his knowledge or consent. The complainant was also 
concerned that the disclosure of his personal information by the Assistant Administrator to the 
Counsel and the disclosure of the criminal conviction information by Counsel at the GSB hearing 
was contrary to the Freedom of Information and Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Assistant Administrator access the complainant’s personnel file prior to 
the GSB hearing, in compliance with Ontario Regulation 460? 


(C) Was the Assistant Administrator’s disclosure of the complainant’s personal 
information to the Counsel, in compliance with section 42 of the Act? 


(D) Was the Counsel’s disclosure of the criminal conviction information at the GSB 
hearing prohibited by the Act? 


RESULTS OF THE INVESTIGATION 
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Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the disclosure of the 
name would reveal other personal information about the individual; 


The information in question was found in the complainant’s personnel file, specifically the fact 
that the complainant had been convicted of mischief for a. particular reason. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Did the Assistant Administrator access the complainant’s personnel file prior 
to the GSB hearing, in compliance with Ontario Regulation 460? 


In his comments on the draft report, the complainant expressed his concern that the Assistant 
Administrator had accessed his personnel file and the criminal conviction information contained 
therein, contrary to the Act. 


Section 4(2) of Ontario Regulation 460 states that: 


Every head shall ensure that only those individuals who need a record for the 
performance of their duties shall have access to it. 


The Ministry advised that, as part of his management responsibilities, the Assistant 
Administrator had previously reviewed the complainant’s personnel file, including the criminal 
conviction information, further to complaints and grievances filed by the complainant himself. 
Consequently, the Assistant Administrator was already familiar with the contents of the 
complainant’s personnel file prior to the grievance in question. The Ministry further stated that 
the Assistant Administrator was also aware of the complainant’s criminal conviction because it 
was general knowledge throughout the facility. 


However, the Ministry advised that prior to being interviewed by the Counsel for the grievance 
in question, the Assistant Administrator had accessed the complainant’s personnel file, for 
information which related to the GSB hearing. According to the Ministry, the complainant was 
either a witness to or had knowledge of various incidents raised by the griever in his grievance. 
The Ministry stated that the Assistant Administrator accessed the complainant’s personnel file 
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in order to prepare for his interview with the Counsel and, ultimately, to assist the Counsel in 
preparing the Ministry’s testimony at the hearing itself. 


It is our view that the Assistant Administrator’s duties included testifying at the GSB hearing and 
briefing the Counsel for that purpose. In order to perform these duties adequately, the Assistant 
Administrator needed to obtain any information that might be related to the GSB hearing. 
Accordingly, it is our view that the Assistant Administrator accessed the complainant’s personnel 
file in compliance with section 4(2) of Ontario Regulation 460. 


Conclusion: The Assistant Administrator accessed the complainant’s personnel file 
prior to the GSB hearing in compliance with Ontario Regulation 460. 


Issue C: Was the Assistant Administrator’s disclosure of the complainant’s personal 
information to the Counsel, in compliance with the section 42 of the Act? 


In his comments on the draft report, the complainant expressed his concern that the Assistant 
Administrator had disclosed his personal information from his personnel file to the Counsel. 


The Ministry advised that the Assistant Administrator disclosed the complainant’s personal 
information during his interview with the Counsel, for the purpose of providing the Counsel with 
any information that would assist her in preparing for the GSB hearing. 


Section 42(d) of the Act states that an institution shall not disclose personal information in its 
custody or under its control except, 


where disclosure is made to an officer or employee of the institution who needs 
the record in the performance of his or her duties and where disclosure is 
necessary and proper in the discharge of the institution’s functions; 


It is our view that one of the Ministry’s functions as an employer is to respond to grievances 
made by one of its employees, and to participate as a party to any litigation (such as a GSB 
hearing) arising from such grievances. 


The Counsel was the Ministry employee who was responsible for representing the Ministry’s 
interests at the GSB hearing. The Ministry took the position that in order to adequately prepare 
and determine what testimony should be presented at the GSB hearing, the Counsel had to be 
aware of any information which might be related to the hearing. 


We accept the Ministry’s submissions, and, as a result, it is our view that section 42(d) of the 
Act applies in the circumstances of this case. The Assistant Administrator disclosed the 
complainant’s personal information to the Counsel, an employee of the Ministry, who needed 
this information in the performance of her duties, and the disclosure was necessary and proper 
in the discharge of one of the Ministry’s functions, i.e., participating in a grievance hearing to 
which it was a party. 
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Conclusion: The Assistant Administrator’s disclosure of the complainant’s personal 
information to the Counsel, was in compliance with section 42 of the Act. 


Issue D: Was the Counsel’s disclosure of the criminal conviction information at the 
GSB hearing prohibited by the Act? 


The Ministry has relied upon section 64(1) of the Act for its authority to disclose the criminal 
conviction information at the GSB hearing. The full text of section 64 states: 


(1) This Act does not impose any limitation on the information otherwise 
available by law to a party to litigation. 


(2) This Act does not affect the power of a court or a tribunal to compel a 
witness to testify or compel the production of a document. 


We have reviewed the Ministry’s submission regarding the application of section 64(1) of the 
Act. In this case, since the information was disclosed during the course of a witness’s 
testimony, we believe that section 64(2) of the Act is the more relevant section to consider. 
Consequently, we have examined the application of section 64(2) of the Act, in the 
circumstances of this complaint. 


In order for section 64(2) of the Act to apply, the tribunal, in this case the GSB, must have the 
power to compel a witness to testify. The Crown Employees Collective Bargaining Act (the 
CECBA) sets out the powers of the GSB. Section 19(2) of the CECBA states that the GSB has 
the same powers as a board of arbitration under section 11(11) of the CECBA. Section 11(11) 
of the CECBA states, in part: 


A board has all the powers of the Tribunal, 


(a) to summon and enforce the attendance of witnesses and to compel them 
to give oral or wmitten evidence on oath or affirmation; 


(c) to accept or exclude any oral testimony, document or other thing. 


Therefore, the GSB has the statutory power to compel a witness to testify at a GSB hearing. 
Section 64(2) of the Act states that the Act does not affect this power. 


In this case, the complainant’s personal information was disclosed by the Counsel in the form 
of a question and confirmed by the witness. The Counsel had asked the question for the purpose 
of bringing the fact of the complainant’s conviction to the attention of the GSB. In our view, 
by confirming the information contained in the Counsel’s question, the disclosure became part 
of the witness’s testimony. Since section 64(2) of the Act states that the Act cannot affect the 
power of a tribunal to compel a witness to testify, it is our view that, in this case, the Ministry’s 
disclosure of the complainant’s personal information during the GSB hearing did not violate the 
provisions of the Act. 
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Thus it is our view that section 64(2) of the Act applies in the circumstances of this case, and 
that the disclosure was not prohibited by the Act. 


The complainant also questioned how the fact of his conviction was relevant to the matter being 
heard by the GSB. However, since we have found that section 64(2) applies to the disclosure 
of the complainant’s personal information at the hearing, it is our view that we cannot make a 
determination under the Act regarding the relevance of the personal information to the issues in 
the proceedings before the GSB. 


Conclusion: The disclosure of the complainant’s personal information by the Counsel 
at the GSB hearing was not prohibited by the Act. 


Other Matters 


During the course of this investigation, the following matters were identified which we would 
like to bring to the Ministry’s attention. 


Record of Disclosure/Use - Sections 45 and 46 


In his comments on the draft report, the complainant expressed his concern that no notation had 
been made in his personnel file stating that: his personal information had been accessed and by 
whom, what information had been removed, and for what purpose. 


Section 46(1) of the Act states that a head shall attach or link to personal information in a 
personal information bank, 


(a) a record of any use of that personal information for a purpose other than a 
purpose described in clause 45(d); and © 


(b) arecord of any disclosure of that personal information to a person other than a 
person described in clause 45(e). 


Section 2(1) of the Act states that the term "personal information. bank" means a collection of 
personal information that is organized and capable of being retrieved using an individual’s name 
or an identifying number or particular assigned to the individual. It is our view that the 
complainant’s personnel file is a such a bank. 


In this case, the Assistant Administrator disclosed the complainant’s personal information to the 
Counsel so that Counsel could use the information to prepare the Ministry’s testimony at the 
hearing. In compliance with section 46(1)(b) of the Act, the Ministry must attach a record of . 
any disclosure to a person other than a person described in clause 45(e). Clause 45(e) states that 
the responsible minister shall publish at least once each year an index of all personal information 
banks, setting forth in respect of each personal information bank, 


(e) to whom the personal information is disclosed on a regular basis; 
The Ministry advised our Office that the personal information bank in the "index", i.e. the 


[IPC Investigation 194-029P/November 30, 1994] 


Ee 


"Directory of Records", which included the personal information in question was the bank 
entitled Performance Management (page 18 of the 1994/95 Directory). Specifically, the bank 
states that an employee’s name, performance contract, and appraisal of work performance may 
be used to manage employees’ performance, and identify staff training needs. The information 
may be used by personnel/human resources staff, training and Employment Equity staff, line 
managers, and auditors. The Ministry stated that since the personal information maintained in 
this bank could be disclosed to line managers, it could be disclosed to the Assistant 
Administrator. However, the Assistant Administrator disclosed the personal information to the 
Counsel who, in our view, was not a person to whom the personal information was disclosed 
on a regular basis as indicated in the index. 


In addition, section 46(3) states: 


Where the personal information in a personal information bank under the control 
of an institution is used or disclosed for a use consistent with the purpose for 
which the information was obtained or compiled by the institution but the use is 
not one of the uses included under clauses 45 (d) and (e), the head shall, 


(a) forthwith notify the responsible minister of the use or disclosure, 
and 


(b) ensure that the use is included in the index. 


In this case the complainant’s personal information was disclosed to the Counsel so that Counsel 
could use the information to prepare the Ministry’s testimony at the hearing. The complainant’s 
personal information was obtained or compiled by the Ministry for the purpose of administering 
its employees. It is thus our view that the complainant’s personal information was disclosed for 
a use consistent with the purpose for which the information was obtained or compiled, but the 
use was not one of the uses included under clauses 45(d) or (e) of the Act. Therefore, in our 
view, the Ministry should have attached a record of the disclosure to the complainant’s personnel 
file, in accordance with section 46(1)(b) of the Act. 


Disclosure Violates Spirit of the Act 


While we have found that the disclosure at the GSB hearing was not prohibited by the Act, it 
is our view that the disclosure of this type of sensitive personal information in the context of a 
hearing, where the subject of the information was not a party to the litigation but rather a 
witness who was compelled to testify, violates the "spirit" of the privacy provisions of the Act. 


Facsimile Transmission 


We also wish to draw the Ministry’s attention to its transmission of personal information by 
facsimile (fax). When responding to this complaint, the Ministry sent its submission to our 
Office by fax. Since this response contained personal information, we wished to remind the 
Ministry of the procedures recommended in our fax guidelines. Accordingly, in our draft 
report, we enclosed a copy of our two papers: "Guidelines on Facsimile Transmission Security, 
June 1989" and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990". 
We recommend that the Ministry review these guidelines and consider incorporating them into 
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its daily practices. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The Assistant Administrator accessed the complainant’s personnel file prior to the GSB 


hearing, in compliance with Ontario Regulation 460. 


e The Assistant Administrator’s disclosure of the complainant’s personal information to the 
Counsel was in compliance with section 42 of the Act.. 


@. The disclosure of the complainant’s personal information by the Counsel at the GSB 
hearing was not prohibited by the Act. 


RECOMMENDATIONS 
We recommend that, 


1. As an interim measure, the Ministry attach or link the following to the complainant’s 
and other employees’ personal information in their personnel files: a record of any 
disclosure of personal information to a person other than one described in clause 45(e), 
in compliance with section 46(1) of the Act. Thus, until such time as this "new" use is 
included in the Directory of Records (see below), whenever personal information from 
an employee’s personnel file is disclosed for the purpose of aiding the Ministry in 
preparing a response to a grievance or for other litigation matters, the Ministry shall 
attach a record of that disclosure. 


2. The Ministry notify the responsible minister of the disclosure, and ensure that the 
"new" use is included in the 1995/96 Directory of Records, in compliance with section 
46(3) of the Act. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Original Signed By: November 30, 1994 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a board of education (the 
Board). 


The complainant had made a request for access to information under the Municipal Freedom of 
Information and Protection of Privacy Act (the Act), with the Board’s Freedom of Information 
and Privacy Co-ordinator (Co-ordinator). The access request form contained the complainant’s 
name, address, unlisted telephone number and a description of the general records requested. 
The complainant: maintained that this information was disclosed by facsimile to the principal of 
the high school where the requested information was held. The complainant was concerned that 
both the transmission of this information by facsimile and its disclosure to the principal were 
contrary to the Act. 


Further, the principal of the high school had telephoned the complainant and had asked why he 
required the information and if he had a student in the school. The complainant made it clear 
that he did not wish to discuss the matter, and did not answer the questions. The complainant 
was concerned that if the principal had collected this information, the collection would have been 
contrary to the Act. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Board’s disclosure of the personal information in accordance with section 
32 of the Act? 
RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information” means recorded information about an identifiable 
individual, including, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


{IPC Investigation 194-030M/August 25, 1994] 


aye 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The access request form completed by the complainant included the complainant’s name, 
address, and unlisted telephone number. 


It is our view that this information met the requirements of paragraphs (d) and (h) of the 
definition of personal information, in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Board’s disclosure of the personal information in accordance with 
section 32 of the Act? 


The complainant had made his request for information under the provisions of the Act, and had 
submitted it directly to the Co-ordinator’s office. The information requested by the complainant 
was the number of teachers teaching the Ontario Academic Credit (OAC) course in Finite 
Mathematics at a particular school and the names of those teachers. Also requested was a copy 
of the most recent final examinations administered in the OAC Finite Mathematics course at that 
school. 


The Board established that the information requested by the complainant was classified as 
general information maintained in "general files". The Board advised that it had a set procedure 
that was to be followed when such files were requested. 


The Board pointed out that this procedure was outlined in a pamphlet entitled "Freedom of 
Information and Protection of Individual Privacy - Information about the (named) Board of 
Education", and in the forward to its "Directory of General Files and Personal Information 
Banks" (the Directory). The Board maintained that if the complainant had "... followed the 
process as outlined in the pamphlet and the directory, there would have been no problem”. 


We examined the pamphlet. It described two procedures for obtaining information from the 
Board. One could obtain information under previously established practices of the Board, or 
under a formal request for information under the Act. 


The first procedure was described under the heading "Directory of Board Records". In this 
section, the Board stated that it had published the Directory which described the organization 
and responsibilities of each department, as well as the records maintained. The Board further 
stated: 
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Persons seeking access to recorded information about the (named) Board of 
Education should consult the directory to determine the location 
(department/school) of the desired information and then contact the person listed 
in the directory. 


The person listed in the directory would then attend to the information requested. The pamphlet 
went on to state that if the "requester" was denied "access to information" and wished to request 
it under the Act, he or she was to contact the Co-ordinator, in order to complete the "required 
application". 


The second procedure was described under the heading "Handling Requests for Information". 
In this section, the Board was referring to requests for information made under the Act. The 
Board stated, in the pamphlet, that the Act was not meant to change the established practice of 
granting information except to further ensure that private information was protected. The Board 
further stated that: "Employees must not grant or deny access to a record that has been 
requested under the Act", and that any time a request was received anywhere within the Board, 
the request was to be forwarded to the Co-ordinator. The Co-ordinator would then process the 
request. 


Thus, the Board made a distinction between obtaining information through its established 
procedure versus making a request for information under the Act. It is our view that an 
individual had the choice of obtaining general records from the Board by using either of the 
Board’s procedures. The Board maintained, however, that the complainant should have followed 
’ its established procedure by contacting the school principal directly rather than the Co-ordinator. 


It is our view that once an individual had elected to make a request for information under the 
Act, the second procedure outlined in the pamphlet should have been followed. Therefore, 
although the Directory established that the information he sought was located at a particular high 
school and that the designated contact person was the principal, the complainant appropnately 
made ‘his request directly to the Co-ordinator. 


Under the Act, an institution shall not disclose personal information except in the circumstances 
outlined in section 32. 


The Board stated that it had relied specifically on section 32(d) of the Act for the disclosure of 
the complainant’s personal information. Section 32(d) states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) if the disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and if the 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 
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When the Co-ordinator received the complainant’s access request under the Act, she forwarded 
the complainant’s completed access request form to the principal of the school where the 
requested information was held. This form contained the complainant’s personal information 
1.e., his name, address and unlisted telephone number. 


One of the duties of the principal was to assist in the processing of the access request by 
compiling the records responsive to the request. However, it is our view that it was not 
necessary for the principal to have the complainant’s personal information in order for him to 
perform this duty. It is, therefore, our view that the Board’s disclosure of the complainant’s 
personal information to the principal was not in accordance with section 32(d) of the Act. 


We examined the remaining provisions of section 32 and found that none applied. 


Conclusion: The Board’s disclosure of the complainant’s personal information was not 
in accordance with section 32 of the Act. 


Other Matters 
We wish to draw attention to the following: 
Attempted Collection of Personal Information 


As previously mentioned, when the principal received the access request from the Co-ordinator, 
he telephoned the complainant and asked why he required the requested information and if he 
had a student in the school. Since the complainant did not wish to discuss the matter, he did not 
answer the questions. The complainant was concerned that had he answered the questions, the 
Board’s collection of this personal information would have contravened the Act. 


Section 28(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


In our view, the processing of a request for access to information under the Act is a lawfully 
authorized activity. However, it is also our view that the principal would not have required the 
additional information in assisting in the processing of the request and therefore, the collection 
of this personal information would not have been in accordance with section 28(2) of the Act, 
as it would not have been "necessary" to the proper administration of a lawfully authorized 
activity. 
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Facsimile Transmission of the Access Request 


Since this complaint concerned the disclosure of personal information through the facsimile 
transmission of the access request form, we wished to remind the Board of our facsimile 
transmission guidelines. Accordingly, we enclosed with our draft report, a copy of the following 
documents: "Guidelines on Facsimile Transmission Security, June 1989" and an "Update on 
1989 Guidelines on Facsimile Transmission Security, June 1990". 


"Freedom of Information and Protection of Individual Privacy" Pamphlet 


In Issue B, we reviewed the two procedures that the Board had described in its pamphlet for 
obtaining information under its custody and control. We found that the Board made a distinction 
between obtaining information through its established procedure versus making a request for 
information under the Act. However, the distinction was not very clear due to the language the 
Board used in describing its established procedure. For example, the Board used the terms 
"requester" and "access to information"; terms which are normally used when referring to the 
access procedure under the Act. And, when the Board did in fact refer to the access procedure 
-under the Act, it did so by using the term "required application", which is not normally 
associated with the Act. 


It is also our view that some of the confusion regarding the two procedures might have stemmed 
directly from the title of the pamphlet itself, since one might assume from its title that all of the 
pamphlet’s contents dealt with procedures under the Act. ' 


Further, in its description of the sections of the Act that concern collection, use, disclosure, and 
retention of personal information, the pamphlet listed as a general rule, three exceptions relating 
to the use and disclosure of personal information. Under the Act, there are more than three 
exceptions allowing for the disclosure of personal information and different exceptions apply to 
use and to disclosure. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The Board’s disclosure of the complainant’s personal information.was not in accordance 


with section 32 of the Act. 
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RECOMMENDATIONS 


Le 


Original Signed by: 


The Board should take steps to ensure that when it receives an access request under the 
Act for general records maintained in another location, the wnitten request is not sent to 
the other location by facsimile or other means, unless all personal identifiers have been 
removed (e.g., name and address). We would like to refer the Board to the enclosed 
copy of "IPC Practices", entitled "Maintaining the Confidentiality of Requesters and 
Privacy Complainants". 


The Board should consider updating its pamphlet to ensure that its procedures for 
obtaining information in its custody and control are more clearly defined. Specifically, 
the Board should ensure that the language which is normally associated with making an 
access request under the Act is not used to describe the Board’s alternative procedure for 
obtaining general records. Reference should also be made to the Act rather than Bill 49, 
when discussing the procedure for an access request under the Act. 


The Board should consider other changes to the pamphlet such as a clarification of the 
use and disclosure exceptions. 


The Board should remind staff involved in the processing of requests for general records 


(either under the Act or through the Board’s "established practices") to collect only 
personal information which is necessary to process the request. 


August 25, 1994 


Susan Anthistle Date 
Compliance Review Officer 


3K OK OK OK 


{IPC Investigation [94-030M/August 25, 1994] 


| » Information and Privacy 
Commissioner/Ontario 
Commissionaire a l'information 


et a la protection de la vie privée/Ontario 


CAZ0 
IP 

INVESTIGATION REPORT 
> 

INVESTIGATION 194-030P 

MINISTRY OF THE SOLICITOR GENERAL 
AND CORRECTIONAL SERVICES 

) 
ee a re tg 


Additional copies of this and other Ontario Government publications are 
available from 

Publications Ontario, 880 Bay St., Toronto for personal shopping. 
Out-of-town customers write to Publications Ontano, 5th Floor, 880 
Bay St., Toronto M7A 1N8. Telephone (416) 326-5300 or toil free in 
Ontario 1-800-668-9938. Hearing impaired call: (416) 965-5130 or 
toll-free in Ontario 1-800-268-7095. Mastercard and Visa accepted. 
Cheques and money orders payable to the Treasurer of Ontano. 
Prepayment required. 


On peut se procurer des exemplaires du présent document ainsi que 
d'autres publications du gouvernemént a Publications Ontario, 880, rue 
Bay, Toronto. Les personnes de l'extérieur peuvent écrire a 
Publications Ontario, 5° étage, 880, me Bay, Toronto (Ontario) 
M7A 1N8 (téléphone : (416) 326-5300 ou, en Ontario, 1-800-668-9938 
sans frais d'interurbain). Les malentendants peuvent composer le 
(416) 965-5130 ou, sans frais en Ontario, le 1-800-268-7095. Les 
cartes de crédit MasterCard et Visa sont acceptées. Faire le chéque ou 
le mandat a l'ordre du tresoner de l'Ontario. Paiement exigé d'avance. 


INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the Solicitor 
General and Correctional Services (the Ministry). 


The complainant had been suspended and had subsequently been dismissed from his employment 
with the Ministry. As a result of his suspension and dismissal, the complainant had filed two 
grievances with the Ministry which had gone before the Grievance Settlement Board (the GSB). 
During the course of the grievance proceedings, the complainant had moved to another province 
and had applied for an employment position with a government department in that province (the 
Department). The Department had written to a superintendent at the Ministry facility where the 
complainant had been employed (the Superintendent), requesting certain information about the 
complainant and his employment with the Ministry. The Superintendent had responded by letter 
to the Department’s questions about the complainant. 


The complainant was concerned that the disclosure of the information in the Superintendent’s 
> letter to the Department had been contrary to the Freedom of Information and Protection of 


Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) — Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did section 37 of the Act apply to the personal information? If not, 
(C) Was the disclosure of the personal information in accordance with section 42 of 
the Act? 
RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


i) Section 2(1) of the Act states, in part: 
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"personal information" means recorded information about an_ identifiable 
individual, including, 


(b) information relating to the education or the medical, 
psychiatric, psychological, criminal or employment history 
of the individual or information relating to financial 
transactions in which the individual has been involved, 


(g) the views or opinions of another individual about the 
individual, and 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the 
disclosure of the name would reveal other personal 
information about the individual; 


The Superintendent’s letter to the Department included information about the complainant’s 
employment with the Ministry - his date of hire, date of transfer, and the date his employment 
was terminated. It included the title and responsibilities of the complainant’s employment 
position. It also included the reason for the complainant’s dismissal from the Ministry, and the 
Superintendent’s opinion about whether he would rehire the complainant. 


It is our view that the complainant’s date of hire, date of transfer, and the date his employment 
was terminated was information which met the requirements of paragraph (b) of the definition 
of personal information in section 2(1) of the Act. 


It is also our view that the reason for the complainant’s dismissal from the Ministry, and the 
Superintendent’s opinion about whether he would rehire the complainant was information which 
met the requirements of paragraphs (g) and (h) of the definition of personal information in 
section 2(1) of the Act. | 


In previous Orders issued by our Office, we found that the title and responsibilities of a position 
of employment was not the personal information of the employee. In this case, it is also our 
view that the complainant’s job title and job responsibilities was not personal information as 
defined in section 2(1) of the Act. 


Conclusion: The complainant’s date of hire, date of transfer and the date the 
complainant’s employment was terminated, the reason for the 
complainant’s dismissal, and the Superintendent’s opinion about whether 
he would rehire the complainant was personal information as defined in 
section 2(1) of the Act. 


The complainant’s job title and job responsibilities was not personal 
information as defined in section 2(1) of the Act. 
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Issue B: Did section 37 of the Act apply to the personal information? 


The Ministry submitted that it disclosed the complainant’s personal information because it had 
already been made public. The Ministry stated that the personal information was a matter of 
public record because the complainant’s suspension and subsequent dismissal from the Ministry 
had been the subjects of an arbitration hearing before the GSB. The proceedings before the GSB 
were open to all members of the public, including media representatives, and the final written 
decision of the GSB was a publicly available document. 


Section 37 of the Act states: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


It is our view that under section 37 of the Act, personal information maintained by an institution 
can be excluded from the application of Part III of the Act only if the personal information is 
maintained by that institution for the purpose of creating a record which is available to the 
general public. In this case, the Ministry could not be said to have been maintaining the 
complainant’s personal information specifically for the purpose of creating a record that was 
available to the general public. Therefore, it is our view that the Ministry could not rely on 
section 37 to exclude the complainant’s personal information from the privacy provisions of Part 
Ill of the Act. 


Conclusion: Section 37 of the Act did not apply to the personal information. 


Issue C: Was the disclosure of the personal information in accordance with section 42 
of the Act? 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 42. 


The Ministry submitted that the disclosure of the complainant’s personal information to the 
Department was in accordance with section 42(b) of the Act. Section 42(b) states that an 
institution shall not disclose personal information in its custody or under its control except, 


where the person to whom the information relates has identified that information 
in particular and consented to its disclosure. 


The Ministry informed us that, according to the Department, it was the usual practice of the 
Department to advise prospective employees during the recruitment interview that employment 
references would be requested from whatever sources were deemed appropriate by the 
Department. In addition, the Department had prospective employees, like the complainant, fill 
out an employment application form. The application contained a section entitled "References" 
which requested that applicants "name three people who know you and your capabilities and to 
whom we may refer in confidence". Directly below this section on the form was a notation 
which stated: "Note-information may be requested from sources other than those listed above”. 
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The Ministry stated that the complainant had implicitly consented to the disclosure of his 
personal information by applying for employment with the Department and signing the 
employment application form. The Ministry submitted that the disclosure was thus in 
accordance with section 42(b) of the Act. 


In determining whether section 42(b) of the Act applied, we considered whether the complainant 
had identified the personal information "in particular" and had consented to its disclosure. 


The complainant had been required to complete the employment application form in order to be 
considered for a position of employment with the Department. The complainant had not 
provided the name of the Superintendent as a reference. He: as not aware that the Department 
had contacted the Superintendent regarding his past employn xt until after this contact had been 
made. In our view, although he had signed the employment .:pplication form which stated that 
"information may be requested from sources other than those listed above", it cannot be said that 
the complainant had identified any specific information that might be obtained from these other 
sources. Therefore, we cannot conclude that the complainant had identified the personal 
information disclosed in the Ministry’s letter, "in particular", nor that he had consented to its 
disclosure. It is thus our view that the Ministry could not rely on section 42(b) of the Act for 
its disclosure of the complainant’s personal information. 


The Ministry also stated that the disclosure of the complainant’s personal information was for 
a "consistent purpose” within the meaning of section 42(c) of the Act. Section 42(c) of the Act 
States that an institution shall not disclose personal information in its custody or under its control 
except "for the purpose for which it was obtained or compiled or for a consistent purpose”. 
Section 43 of the Act further provides that: 


Where personal information has been collected directly from the individual to 
whom the information relates, the purpose of a use or disclosure of that 
information is a consistent purpose under clauses 41(b) and 42(c) only if the 
individual might reasonably have expected such a use or disclosure. 


The Ministry stated that the complainant should have reasonably expected that his prospective 
employer would need to verify that the information on his employment application form and 
resume was both factual and truthful. With reference specifically to the disclosure of the 
Superintendent’s opinion of whether the complainant was suitable for rehire, the Ministry stated 
that the complainant should have reasonably expected that his prospective employer would want 
to know this type of information. 


In our view, the Ministry had compiled the complainant’s date of hire, date of transfer, and the 
date his employment was terminated, the reason for his termination, and the Superintendent’s 
opinion about the complainant’s suitability for rehire, for internal human resources purposes, 
such as employee admir:stration and performance evaluation. The Ministry subsequently 
disclosed this personal information to the Department for the purpose of responding to the 
Department’s request for information about the complainant’s employment with the Ministry. 
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Although the complainant had not identified the Superintendent as a reference on the employment 
application form, it is our view that by completing the form he was aware that information could 
be requested from sources other than those he had listed and that he might reasonably have 
expected that one of the sources would be an appropriate official at his last place of employment 
at the Ministry. 


Further, it is our view that the complainant might also reasonably have expected that in such a 
contact, the Ministry would disclose information about his employment, including the reason for 
his termination and his suitability for rehire. Therefore, in our view, the Ministry’s disclosure 
of the complainant’s personal information was for a purpose that was "consistent" with the 
purpose for which the information had been compiled. The disclosure was, thus, in accordance 
with section 42(c) of the Act. : 


Conclusion: The Ministry’s disclosure of the complainant’s personal information was 
in accordance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


e The complainant’s date of hire, date of transfer and the date the complainant’s 
employment was terminated, the reason for the complainant’s dismissal, and the 
Superintendent’s opinion about whether he would rehire the complainant was personal 
information as defined in section 2(1) of the Act. 

The complainant’s job title and job responsibilities was not personal information as 
defined in section 2(1) of the Act. 


8 Section 37 of the Act did not apply to the personal information. 


e The Ministry’s disclosure of the complainant’s personal information was in accordance 
with section 42 of the Act. 


Original Signed By: October 12, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a police services board (the 
Police). 


The complainant had applied for a renewal of a Firearms Acquisition Certificate (FAC) with the 
Police. Around the time that the complainant had made the application for renewal, he 
underwent elective surgery. Due to the nature of the surgery, the Ministry of Transportation 
temporarily suspended his driving privileges. 

During the course of processing the complainant’s renewal application for the FAC, the Police 
did a check with the Canadian Police Information Centre (CPIC). The complainant’s CPIC 
printout indicated that his driving privileges had been suspended for medical reasons. When 
questioned by the Police as to why his driver’s licence had been suspended for medical reasons, 
the complainant said that he had undergone surgery and was recovering. The Police then 
collected from the complainant a copy of a letter containing his medical information, wmitten by 
his doctor. The complainant then received his FAC. 


The complainant was concerned that the collection of his medical information by the Police was 
contrary to the Municipal Freedom ‘of Information and Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined by section 
2(1) of the Act? If yes, 


(B) Did the Police collect the personal information in accordance with section 28(2) 


of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined by section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 
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(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The information in question was contained in a letter written by the complainant’s doctor. It 
included the complainant’s name, address, medical information, and information regarding the 
duration of his disability. It also identified the division of the hospital associated with the 
complainant’s surgery and doctor, thereby identifying the nature of his surgery. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Did the Police collect the personal information in accordance with section 
28(2) of the Act? 


Section 28(2) of the Act states: 


(2) No person shall collect personal information on behalf of an institution unless 
the collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Police have stated that the Criminal Code of Canada is the lawful authority for the collection 
of the complainant’s personal information. Section 106(1) of the Criminal Code of Canada 
States: 


Where a firearms officer who has received an application for a firearms 
acquisition certificate and the fee prescribed by regulation does not, after 
considering the information contained in the application, any further information 
that is submitted to the firearms officer pursuant to a requirement under 
subsection (9) and such other information as may reasonably be regarded as 
relevant to the application, have notice of any matter that may render it desirable 
in the interests of the safety of the applicant or of any other person that the 
applicant should not acquire a firearm, the firearms officer shall, subject to 
subsection (2), and after at least twenty-eight days have elapsed since the 
application was received, issue a firearms acquisition certificate to the applicant. 


Section 106(9) of the Criminal Code of Canada states: 
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A firearms officer who has received an application for a firearms acquisition 
certificate may require the applicant to submit such further information in addition 
to that included in the application as may reasonably be regarded as relevant for 
the purpose of determining whether there is any matter that might render it 
dangerous for the safety of the applicant or of any other person if the applicant 
acquired a firearm. 


It is our view that processing an application for an FAC, with a view to granting or denying the 
FAC, is a lawfully authorized activity. 


It is also our view that the collection of further information that is relevant to making a 
determination regarding approval or denial of the FAC, is necessary to the proper administration 
of processing the application for the FAC. 


In this case, the Firearms Clerk was aware that the complainant’s driving privileges had been 
suspended for medical reasons. In consideration of the safety of the applicant, i.e. the 
complainant, and any other person, the Police were required to ensure that there was no reason 
why the complainant should not acquire a firearm. In our view, in order to do this, it was 
necessary for the Police to obtain more specific information regarding the medical reasons which 
were the cause of the suspension of the complainant’s driver’s license. 


Therefore, in our view, the Police’s collection of the medical note, containing the complainant’s 
personal information, was necessary to the proper administration of the lawfully authorized 
activity of processing, and approving or denying, the application for the FAC. It is, thus, our 
view that the collection of the complainant’s personal information was in accordance with section 
28(2) of the Act. 


Conclusion: The collection of the complainant’s personal information was in 
accordance with section 28(2) of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 

e The collection of the personal information was in accordance with section 28(2) of the 
Act. 

Original Signed by: August 22, 1994 

Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named separate school 
board (the Board). 


The complainants’ child was a student attending one of the Board’s schools. The child was 
referred by the Board to a Special Education Identification, Placement and Review Committee 
(the Committee) for an assessment. The Committee identified exceptional pupils and 
recommended suitable placements for them. 


The complainants consented to the assessment because they wished to establish that their child 
had chemical sensitivities which affected his learning ability. The complainants hoped that the 
Committee would determine that a chemical-free environment would be the most suitable 
placement for their child. The complainants gave the Board written permission to contact their 
child’s clinicians to collect their child’s medical and mental health information. 


An assessment was subsequently conducted. The child was identified as exceptional and 
recommendations were made with respect to a suitable placement for him. The complainants, 
however, did not agree with the Committee’s determination and recommendations, and 
subsequently filed an appeal. A Special Education Appeal Board (the Appeal Board) was 
established to hear the appeal. 


After the complainants appealed the Committee’s determination, they informed the Board’s 
Director of Education, by letter, that all medical and mental health information pertaining to 
their child would be treated by his clinicians as confidential, thus revoking their permission for 
the Board to collect any further information from the clinicians. A Board psychologist 
subsequently made an inquiry of one of the child’s clinicians. He asked the clinician’s secretary 
whether a status report on the child was available, and was informed that the clinician had not 
seen the child lately and that there were no reports. 


The complainants maintained that the Board had collected their child’s personal information 
without their consent, and that the collection was not in compliance with the Municipal Freedom 


of Information and Protection of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) | Was the Board’s collection of the child’s personal information in compliance with 
section 28(2) of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information iu &restiuon “personal information", as GoM ed ix. _--tion 
2(1) of the Act? 


Section 2(1) of the Act states in part, 


“personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name if it appears with other personal 
information relating to the individual or where the 
disclosure of the name would reveal other personal 
information about the individual; 


The information in question which was provided to the Board’s doctor by the clinician’s office, 
was that no medical report about the child was available because the clinician had not seen the 
child. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section ( 
2(1) of the Act. 


Issue B: Was the Board’s collection of the child’s personal information in compliance 
with section 28(2) of the Act? 


The Board submitted that its collection of the child’s personal information was in compliance 
with section 28(2) of the Act. This section states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. [emphasis added] 


Regulation 305 of the Education Act sets out the powers and procedures of the Committee and 
Appeal Board. Section 4(1) of Regulation 305 indicates that a parent of a pupil who disagrees 
with a determination made by the Committee may give a written notice of appeal of the 
determination of the Committee and the Board shall appoint an Appeal Board to deal with the 
appeal. 
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In this case, after the Committee had made its decisions regarding the complainant’s child, 
further to section 4(1) of Regulation 305, the complainants requested an appeal on the grounds 
of the decision of the Committee, and subsequently, the Board established the Appeal Board to 
hear the appeal. 


The complainants indicated that it was their belief that when they had revoked their consent to 
the Committee to consult with their child’s clinician, this would have prevented the Board from 
obtaining any further information about their child. The complainants further stated that it was 
their view that their child had missed an entire year of school, much to his detriment, as a result 
of the Board’s collection of his personal information. 


Section 28(2) of the Act does not list consent as one of the conditions under which personal 
information may be collected. Further, while section 2(3)(a) of Regulation 305 of the Education 
Act requires the Committee to obtain a parent’s written permission before obtaining and 
considering a child’s health and psychological assessment, section 7 of the Regulation, the 
comparative section at the appeal stage, is silent on this point. Therefore, there is no specific 
requirement for parental consent for collecting further information about a child at the appeal 
stage. 


The Board advised that the Appeal Board relies on the parties, 1.e. the Board and the appellants, 
to provide the information necessary to make its decision. Section 7 of Regulation 305 of the 
Education Act states in part: 


(8) Any person who in the opinion of an Appeal Board may be able to 
contribute information with respect to the matters before the Appeal 
Board shall be invited to attend the discussion and the discussion shall 
be conducted in an informal manner. (emphasis added) 


(9) Where in the opinion of an Appeal Board all the opinions, views and 
information that bear upon the matters under appeal have been 
presented to the Appeal Board, the Appeal Board shall adjourn the 
discussion and within three days thereafter may, ... (emphasis added) 


The Board informed us that, at the time of its collection of the child’s information, its staff were 
preparing for the complainants’ appeal of the Committee’s determination. The Board stated that, 
as part of the appeal process, its psychologist, in calling the clinician, "was merely attempting 
to confirm if the results of the psycho-educational assessment might be available in time for the 
appeal hearing." 


The Board further stated that results from a psycho-educational assessment were regularly used 
as support information to the Appeal Board’s deliberations when reviewing the recommendations 
of the Committee. 


It is our view that further to section 7 of Regulation 305 of the Education Act, the parties to the 


appeal hearing should be permitted to place the relevant information before the Appeal Board 
to ensure that it will be in a position to make an informed decision. 
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It is also our view that the Board’s preparation for the appeal hearing before the Appeal Board 
was a lawfully authorized activity of the Board. In this case, the Board had collected only the 
information that a report was not available because the clinician had not seen the child. No 
specific medical details were collected. As part of its preparations for the appeal hearing, it was 
necessary for the Board to confirm whether or not the report of the psycho-educational 
assessment would be available to the Appeal Board, since this information could be relevant to 
the Appeal Board’s deliberations. 


Therefore, in the circumstances of this case, it is our view that the Board’s collection of the 
child’s personal information was necessary to the proper administration of a lawfully authorized 
activity, and was thus in compliance with section 28(2) of the Act. 

Conclusion: The Board’s collection of the child’s personal information was in 


compliance with section 28(2) of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The Board’s collection of the child’s personal information was in compliance with section 


28(2) of the Act. 


Onginal Signed by: March 13, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named separate school 
board (the Board). 


The complainants’ child was a student attending one of the Board’s schools. The child was 
referred by the Board to a Special Education Identification, Placement and Review Committee 
(the Committee) for an assessment. The Committee identified exceptional pupils and 
recommended suitable placements for them. 


The complainants consented to the assessment because they wished to establish that their child 
had chemical sensitivities which affected his learning ability. The complainants hoped that the 
Committee would determine that a chemical-free environment would be the most suitable 
placement for their child. The complainants gave the Board written permission to contact their 
child’s clinicians to collect their child’s medical and mental health information. 


An assessment was subsequently conducted. The child was identified as exceptional and 
recommendations were made with respect to a suitable placement for him. The complainants, 
however, did not agree with the Committee’s determination and recommendations, and 
subsequently filed an appeal. A Special Education Appeal Board (the Appeal Board) was 
established to hear the appeal. 


After the complainants appealed the Committee’s determination, they informed the Board’s 
Director of Education, by letter, that all medical and mental health information pertaining to 
their child would be treated by his clinicians as confidential, thus revoking their permission for 
the Board to collect any further information from the clinicians. A Board psychologist 
subsequently made an inquiry of one of the child’s clinicians. He asked the clinician’s secretary 
whether a status report on the child was available, and was informed that the clinician had not 
seen the child lately and that there were no reports. 


The complainants maintained that the Board had collected their child’s personal information 
without their consent, and that the collection was not in compliance with the Municipal Freedom 


of Information and Protection of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Board’s collection of the child’s personal information in compliance with 
section 28(2) of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states in part, 


“personal information" means recorded information about an_ identifiable 
individual, including, 


(h) the individual’s name if it appears with other personal 
information relating to the individual or where the 
disclosure of the name would reveal other personal 
information about the individual; 


The information in question which was provided to the Board’s doctor by the clinician’s office, 
was that no medical report about the child was available because the clinician had not seen the 
child. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Board’s collection of the child’s personal information in compliance 
with section 28(2) of the Act? 


The Board submitted that its collection of the child’s personal information was in compliance 
with section 28(2) of the Act. This section states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. [emphasis added] 


Regulation 305 of the Education Act sets out the powers and procedures of the Committee and 
Appeal Board. Section 4(1) of Regulation 305 indicates that a parent of a pupil who disagrees 
with a determination made by the Committee may give a written notice of appeal of the 
determination of the Committee and the Board shall appoint an Appeal Board to deal with the 
appeal. 
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In this case, after the Committee had made its decisions regarding the complainant’s child, 
further to section 4(1) of Regulation 305, the complainants requested an appeal on the grounds 
of the decision of the Committee, and subsequently, the Board established the Appeal Board to 
hear the appeal. 


The complainants indicated that it was their belief that when they had revoked their consent to 
the Committee to consult with their child’s clinician, this would have prevented the Board from 
obtaining any further information about their child. The complainants further stated that it was 
their view that their child had missed an entire year of school, much to his detriment, as a result 
of the Board’s collection of his personal information. 


Section 28(2) of the Act does not list consent as one of the conditions under which personal 
information may be collected. Further, while section 2(3)(a) of Regulation 305 of the Education 
Act requires the Committee to obtain a parent’s written permission before obtaining and 
considering a child’s health and psychological assessment, section 7 of the Regulation, the 
comparative section at the appeal stage, is silent on this point. Therefore, there is no specific 
requirement for parental consent for collecting further information about a child at the appeal 
stage. 


The Board advised that the Appeal Board relies on the parties, i.e. the Board and the appellants, 
to provide the information necessary to make its decision. Section 7 of Regulation 305 of the 
Education Act states in part: 


(8) Any person who in the opinion of an Appeal Board may be able to 
contribute information with respect to the matters before the Appeal 
Board shall be invited to attend the discussion and the discussion shall 
be conducted in an informal manner. (emphasis added) 


(9) Where in the opinion of an Appeal Board all the opinions, views and 
information that bear upon the matters under appeal have been 
presented to the Appeal Board, the Appeal Board shall adjourn the 
discussion and within three days thereafter may, ... (emphasis added) 


The Board informed us that, at the time of its collection of the child’s information, its staff were 
preparing for the complainants’ appeal of the Committee’s determination. The Board stated that, 
as part of the appeal process, its psychologist, in calling the clinician, "was merely attempting 
to confirm if the results of the psycho-educational assessment might be available in time for the 
appeal hearing.” 


The Board further stated that results from a psycho-educational assessment were regularly used 
as support information to the Appeal Board’s deliberations when reviewing the recommendations 
of the Committee. 


It is our view that further to section 7 of Regulation 305 of the Education Act, the parties to the 


appeal hearing should be permitted to place the relevant information before the Appeal Board 
to ensure that it will be in a position to make an informed decision. 
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It is also our view that the Board’s preparation for the appeal hearing before the Appeal Board 
was a lawfully authorized activity of the Board. In this case, the Board had collected only the 
information that a report was not available because the clinician had not seen the child. No 
specific medical details were collected. As part of its preparations for the appeal hearing, it was 
necessary for the Board to confirm whether or not the report of the psycho-educational 
assessment would be available to the Appeal Board, since this information could be relevant to 
the Appeal Board’s deliberations. 


Therefore, in the circumstances of this case, it is our view that the Board’s collection of the 
child’s personal information was necessary to the proper administration of a lawfully authorized 
activity, and was thus in compliance with section 28(2) of the Act. 

Conclusion: The Board’s collection of the child’s personal information was in 


compliance with section 28(2) of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The Board’s collection of the child’s personal information was in compliance with section 


28(2) of the Act. 


Original Signed by: March 13, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a separate school board (the 
Board). 


The complainant is a Roman Catholic who supports the public school system. She received a 
letter from the Board advising her that under the Education Act, she was entitled to direct the 
education portion of her property tax to the Board. Enclosed with the letter was a form which 
the complainant could sign if she wished to support the separate rather than the public: school 
system. 


The complainant believed that the Board had taken copies of assessment records at "City Hall" 
in order to use the personal information they contained to solicit tax support from Roman 
Catholics who did not support the Board. She objected specifically to the Board’s use of her 
personal information for what she believed was for the purpose of soliciting tax dollars from her 
and for questioning her decision to support the public school system. She believed that the 
Board’s use of her personal information was not in So Ce with the Municipal Freedom of 


Information and Protection of Privacy Act (the Act ph 


Under section 14 of the Assessment Act, the assessment commissioner for each assessment 
region is required to prepare an assessment roll that includes such information as the name and 
surname of any person liable to assessment (i.e. a ratepayer); his/her religion,. if Roman 
Catholic; and whether he or she is a public or separate school supporter. Under section 16 of 
the Assessment Act, the assessment commissioner is required to prepare a list indicating the 
school support of each ratepayer in each municipality in the assessment region and to deliver it 
to each school board in the municipality. It was information about the complainant from such 
a list (the school list) that Board used when it wrote to her. 


- Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Board’s use of the personal information in compliance with section 31 
of the Act? 


RESULTS OF THE INVESTIGATION 
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Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states in part: 


"personal information" is recorded information about an identifiable individual, 
including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
age, sex, sexual orientation or marital or family status of the individual, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The school list contained the complainant’s name, address, gender, and religion. It included the 
information that she was a supporter of the public school system and other details about her. 


In our view, this information satisfied the requirements of paragraphs (a), (d), and (h) of the 
definition of "personal information” in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Board’s use of the personal information in compliance with section 
31 of the Act? 


Under the Act, personal information in the custody or control of an institution cannot be used 
except in the specific circumstances outlined in section 31. The Board submitted that the 
complainant’s personal information was used in accordance with sections 31(a) and (b) of the 
Act. 


Section 31(a) states that an institution shall not use personal information in its custody or under 


its control "except if the person to whom the information relates has identified that information 
in particular and has consented to its use." 
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It was the Board’s view that there existed an implicit consent for the use of religious information 
in the manner in which the Board had used it. The Board stated that the public had authorized 
the legislature to require ratepayers to provide such information for inclusion in the assessment 
roll. The Board further stated that since there was no purpose for the collection of the 
information (included on the school list) other than for use by school boards, this "type of use 
has been consented by the electorate of Ontario." 


It is our view, however, that section 31(a) of the Act did not apply to the circumstances of this 
case, since it could not be said that with respect to the personal information used by the Board, 
the complainant had identified it "in particular" and had consented to its use. 


The Board submitted that section 31(b) of the Act was also applicable. Section 31(b) states that 
an institution shall not use personal information in its custody or under its control "except for 
the purpose for which it was obtained or compiled or for a consistent purpose." 


The Board submitted that the underlying principle of the assessment system is to allow both the 
public and separate school systems to compete for support from Roman Catholic ratepayers. It 
was the Board’s view that Roman Catholic ratepayers have the right to form separate school 
boards under section 80 of the Education Act. Further, Section 106 of the Education Act 
provides that every person who pays rates as a separate school supporter is exempt from public 
payment of taxes for public school purposes. 


Section 80 of the Education Act states in part: 


A public meeting of persons desiring to establish a separate school zone may be 
convened by, 


(a) not fewer than five heads of families, being Roman Catholics and being 
householders or freeholders resident within a municipality... 


Section 106 of the Education Act states in part: 


(1) Every person paying rates in a separate school zone on property that the 
person occupies as owner or tenant or on unoccupied property that the person 
owns, who personally or by his or her agent, on or before the 30th day of 
September in any year, gives to the clerk of the municipality notice in writing that 
the person is a Roman Catholic and wishes to be a separate school supporter, is 
exempt from the payment of all rates imposed on such property in the separate 
school zone for public school purposes ... 


The Board stated that the ratepayer information is collected by the assessment commissioner and 
then passed on to the school boards via the school lists, to enable boards to advise Roman 
Catholics of their options (ie., that they could give their support to either the public or separate 
school system). The Board referred to section 16 of the Assessment Act. 
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Section 16 of the Assessment Act states in part: 


(1) | The assessment commissioner shall, in each year, prepare a list showing 
the school support of every inhabitant who is entitled to direct taxes for school 
support purposes for each municipality or locality in the commissioner’s 
assessment region and shall deliver the list to the secretary of each school board 
in the municipality or the locality on or before the 30th day of September of each 
year. 


(3) Any person may apply to the assessment commissioner to have that 
person’s name included or altered in the assessment roll as a separate school 
supporter, if the person is a Roman Catholic, or a public school supporter and the 
assessment commissioner may make the addition or alteration. 


(5) At the request of the secretary of the school board, the assessment 
commissioner may deliver the list referred to in subjection (1) in a format that 
will facilitate the use of mechanical or electronic means in the printing, 
reproduction or other use of the list. (emphasis added) 


It was the Board’s view that since the Assessment Act specifically provided for the Board to 
have and to use the information contained in the school list, the Board had the right and 
responsibility to use this information to advise Roman Catholics of their right to direct their 
funds to the separate school system, if they so wished. 


The Board stated that the information on the school list "is not used for any other purpose... 
information respecting religion has been used only for the purpose for which it was obtained, 
the ascertainment of potential supporters..." It was the Board’s view that it was not soliciting 
support "per se". "Ratepayers cannot be assumed to be familiar with their rights under the 
Education Act and the Assessment Act. What we do is to use the information .. to inform 
Catholic ratepayers of their rights..." 


The Board also advised that in its current form letter, a paragraph has been added which clarifies 
that the issue of separate school support is a voluntary undertaking. Ratepayers are told that if 
they choose not to change their support to the separate system, to disregard the attached forms. 


We have considered both the Board’s representations and the relevant legislation. It is our view 
that in this case, the Board had obtained the complainant’s personal information on the school 
list for the purpose of ascertaining if the information that the complainant was a supporter of the 
public school system was correct and to advise her that she had the option of directing her taxes 
to the separate school system. The Board then used this personal information for the very same 
purpose. It is, therefore, our view that the Board’s use of the complainant’s personal 
information was in compliance with section 31(b) of the Act, for the same purpose for which 
it had been obtained. 


Conclusion: The Board’s use of the personal information was in compliance with 
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section 31 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 

e The Board’s use of the personal information was in compliance with section 31 of the 
Act. 

Original Signed by: mee Octobers 7081994 

Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a regional police force (the 
Police). 


The complainant, a private in the Canadian Armed Forces, was driving a military vehicle when 
he was stopped by a police officer for a traffic violation. The Police Officer requested the 
complainant’s name, birth date, home address and driver’s licence. The complainant provided 
his name, birth date, military base address and his military driver’s licence, Form DND-404. 
The Police Officer requested the complainant’s Ontario driver’s license issued by the Ministry 
of Transportation (MTO) under the Highway Traffic Act. The complainant refused to provide 
the MTO driver’s license. The Police Officer then checked the complainant on the Canadian 
Police Information Centre (CPIC) by using his name and birth date. CPIC provided the Police 
Officer with the complainant’s home address and his MTO driver’s licence number. The Police 
Officer then wrote the complainant a Provincial Offences Notice ticket (the Ticket) for the traffic 
violation, using the MTO driver’s license number. 


The complainant stated that the Police should have accepted his military driver’s license and 
should not have collected his MTO driver’s license number from CPIC. He was concerned that 


the Police’s collection and use of this information was contrary to the Municipal Freedom of 
Information and Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Police’s collection of the personal information in compliance with section 
28(2) of the Act? 


(C) Was the Police’s use of the personal information in compliance with section 31 
of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: ‘Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 
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(a) information relating to the race, national or ethnic origin, 
colour, religion, age, sex, sexual orientation or marital or 
family status of the individual, 


(c) any identifying number, symbol or other particular assigned 
to the individual, 


(d) the address, telephone number, fingerprints or blood type 
of the individual, 


The information in question was the complainant’s name, birth date, home address and MTO 
driver’s licence number. 


It is our view that this information met the requirements of paragraphs (a), (c), and (d) of the 
definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Police’s collection of the personal information in compliance with 
section 28(2) of the Act? 


Under the Act, personal information cannot be collected except in the specific circumstances 
outlined in section 28(2) of the Act which states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Police stated that they are responsible for enforcing and regulating compliance with the 
Criminal Code of Canada as well as provincial and municipal legislation. CPIC is a national 
repository of police operational information that is a vital resource shared within Canadian law 
enforcement agencies. The Police advised us that CPIC is a tool used by police in carrying out 
their duties as dictated by the Police Services Act. For example, it is a regular procedure to run 
a CPIC check on a person stopped by a police officer for a driving violation. CPIC is used to 
ascertain if a person is wanted on a criminal warrant, for an investigation, or is a suspended 
driver. CPIC also gives officers pertinent information needed for public and officer safety. The 
CPIC system gives information about whether a person is violent or a possible suicide risk. 


The Police advised us that the complainant’s name and birth date were collected from the 
complainant for the purpose of checking the CPIC system to see if the complainant had been 
suspended from driving, and for the purpose of issuing the Ticket for the traffic violation. The 
complainant’s MTO driver’s license number was collected from CPIC by the Police Officer also 
for the purpose of issuing the Ticket for the traffic violation. The Police stated that all of the 
complainant’s personal information was collected to be used for the purpose of law enforcement, 
in compliance with section 28(2) of the Act. 
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In our view, the complainant’s name and birth date were collected during the course of the 
Police Officer’s duties as a law enforcement officer, further to the Police Services Act. The 
collection was for the purpose of checking the CPIC system regarding whether the complainant 
had been suspended from driving, and to prepare a complete Ticket. Since the complainant’s 
name and birth date were used for the purposes of law enforcement, it is our view that the 
collection of this personal information was in compliance with section 28(2) of the Act. 


In our view, the Police collected the complainant’s MTO driver’s license number to issue him 
a ticket for his traffic violation, for the purpose of enforcing the Highway Traffic Act. Since 
the Police used the complainant’s MTO driver’s license number for the purposes of law 
enforcement, it is our view that the collection of this personal information was in compliance 
with section 28(2) of the Act. | 


With regard to the collection of the complainant’s home address, the Ticket contained the 
complainant’s military address and not his home address. In our view, in order for a collection 
to have taken place, retention of the information in a recorded form must occur. Since the 
Police Officer did not record the complainant’s home address on the Ticket, the collection of the 
- complainant’s home address in a recorded form did not take place and section 28(2) of the Act 
did not apply. 


Conclusion: The Police collected the complainant’s name, birth date, and MTO 
driver’s license number in compliance with section 28(2) of the Act. 


The Police did not collect the complainant’s home address, therefore, 
section 28(2) of the Act did not apply. 


Issue C: Was the Police’s use of the personal information in compliance with section 
31 of the Act? 


Under the Act, personal information in the custody and control of an institution cannot be used 
except in the specific circumstances outlined in section 31 of the Act . 


_ The Police stated that they relied upon section 31(b) of the Act as its authority for the use of the 
complainant’s personal information. This section states that an institution shall not use personal 
information in its custody or under its control except “for the purpose for which it was obtained 
or compiled or for a consistent purpose”. 


The Police used the complainant’s name and birth date to check the CPIC system to determine 
whether the complainant had been suspended from driving, and to complete the Ticket for the 
traffic violation. In Issue B we found that the complainant’s name and birth date were collected 
by the Police for the purposes of law enforcement. Since the complainant’s name and birth date 
were used for the purpose for which they were obtained by the Police, their use was in 
compliance with section 31(b) of the Act. 


The Police informed us that information available from CPIC is used to detect, prevent and 
suppress crime and to enforce of the law. The Police Officer used the complainant’s MTO 
driver’s license number for the purpose of issuing the complainant a ticket for a traffic violation 


[IPC Investigation 194-048M/December 22, 1994] 


AG 


under the Highway Traffic Act. Since the complainant’s MTO driver’s license number was 
collected for use for law enforcement purposes, it is our view that the complainant’s personal 
information was used for the purpose for which it was obtained by the Police, in compliance 
with section 31(b) of the Act. 


Conclusion: The Police used the complainant’s personal information in compliance 
with section 31 of the Act. 


Other Matters 


The complainant stated that he thought that the Police Officer should have accepted his military 
license instead of his MTO driver’s license number, in order to complete the Ticket. However, 
since there was no collection and use of the complainant’s military driver’s license under the 
Act, its provisions do not apply to this matter and we are unable to comment further. 


The Police, nevertheless, advised us that they felt that they should clarify their "Policy and 
Procedure" which deals with military drivers and vehicles for police officers. Therefore, the 
Police are in the process of reviewing the National Defence Act and other relevant legislation, 
to determine whether the present "Policy and Procedure" should be revised. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The Police collected the complainant’s name, birth date and MTO driver’s license 


number in compliance with section 28(2) of the Act. 


The Police did not collect the complainant’s home address, therefore, section 28(2) of 
the Act did not apply. é 


e The Police used the complainant’s personal information in compliance with section 31 
of the Act. 

Original Signed By: December 22, 1994 

Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a psychiatric hospital (the 
Hospital) of the Ministry of Health (the Ministry). 


The complainant, an employee of the Ministry, was working under a Memorandum of 
Agreement between herself and the Ministry to better accommodate her in the workplace, further 
to the Ontario Public Service’s Employment Equity Program. The complainant had a severe 
shellfish allergy. During the course of adjusting the complainant’s working arrangements under 
the Memorandum of Agreement, the complainant’s personal information, including her medical 
information and employee accommodation requirements, was disclosed to the Director of 
Medical Services (the Director) at the Hospital. 


The complainant was concerned that the disclosure of this information to the Director, without 
her consent, was not in compliance with the Freedom of Information and Protection of Privacy 
Act (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Ministry’s disclosure of the complainant’s personal information to the 


Director in accordance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION - 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the 
disclosure of the name would reveal other personal 
information about the individual; 
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The information in question consisted of the Memorandum of Agreement dated January 15, 
1993, six internal memoranda dated April 25, 1994, June 16, 1994, and June 30, 1994, and two 
medical letters from the complainant’s doctors dated June 19, 1992 and March 3, 1993. The 
information contained in these documents included the complainant’s name together with her 
medical information, information about her special employment requirements, and arrangements 
that had been made for her by the Ministry. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Ministry’s disclosure of the complainant’s personal information to 
the Director in accordance with section 42 of the Act? 


Under the Act, personal information cannot be disclosed except in the specific circumstances 
outlined in section 42. The Ministry stated that it had relied upon sections 42(c) and (d) of the 
Act for the disclosure. Section 42(c) states that: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or 
for a consistent purpose; 


Section 43 further provides that: 


Where personal information has been collected directly from the individual to 
whom the information relates, the purpose of a use or disclosure of that 
information is a consistent purpose under clauses 41(b) and 42(c) only if the 
individual might reasonably have expected such a use or disclosure. 


The Ministry stated that the nursing administration at the Hospital had explored alternative 
programs and work setups to provide the complainant with a safer and more controlled work 
environment. Part of these efforts had included consultation with the Director, who was familiar 
with all the wards, the patient population and the overall operation of the Hospital. 


It was the Ministry’s view that, considering the Director’s position in the Hospital and his 
knowledge, both administrative and medical, of all wards, programs and dietary regimes, the 
disclosure of her personal information, as part of the Hospital’s efforts to assign her to an 
allergen-free work environment, might reasonably have been expected by the complainant. The 
Ministry maintained that the disclosure was, thus, for a consistent purpose in compliance with 
section 42(c) of the Act. 
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The complainant informed us that the Hospital had requested that she sign two different 
authorization letters giving her consent to allow the release of her medical information to the 
Hospital. The complainant had refused to sign the authorizations because she felt that they were 
too broad. The complainant was not aware that the Director had been consulted until after she 
had received a copy of the Director’s memorandum relating to that consultation. 


It is our view that since the complainant had not signed the authorization letters and had not been 
informed that the Director would be consulted as part of the Ministry’s arrangements for the 
employment accommodation, she would not reasonably have expected that her personal 
information would be disclosed to the Director. Therefore, it is our view that the disclosure was 
not for a consistent purpose and was not in compliance with section 42(c) of the Act. 


The Ministry also relied upon section 42(d) of the Act which states that an institution shall not 
disclose personal information in its custody or under its control except: 


(d) where disclosure is made to an officer or employee of the 
institution who needs the record in the performance of his 
or her duties and where disclosure is necessary and proper 
in the discharge of the institution’s functions; 


The Ministry advised us that Medical Services staff, including the Director, provide direct and 
indirect health and safety services to the Hospital and its employees on an informal basis. These 
services include sporadic adhoc workplace accommodation consultation to the Employee Health 
nurse, management staff and employees, and sporadic adhoc rudimentary medical 
consultation/referral to employees, upon request. : 


The Ministry submitted that the Director’s previous experience as an occupational health and 
safety physician, together with his medical expertise, enabled him to provide valuable input into 
the determination of appropriate assignments for the complainant. As Medical Director, the 
Director had to weigh the net effect of the complainant’s accommodation agreement on the 
patients on various wards, with a view to minimizing negative impacts on patients’ menus and 
nutrition. It was for this reason, as well as for his background and knowledge of the Hospital’s 
patient population and ward structure, that the Director’s opinion was deemed of value. The 
Ministry submitted that, therefore, the Director needed the complainant’s personal information 
in the performance of his duties of assisting the Hospital and the complainant in reaching a 
satisfactory resolution regarding the complainant’s employment accommodation requirements. 


The complainant informed us that the Director was responsible for providing medical care to the 
patients of the Hospital, and not the staff. She stated that the Director was not a specialist in 
her medical condition. The complainant had provided the Hospital with medical letters from her 
specialist doctors regarding her condition, and she maintained that consultation with the Director 
was unnecessary. She also advised that it was not within the normal course of the Director’s 
duties to do a consultation of this nature. 
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It is our view that the provision of a work environment in which an employee’s particular 
accommodation needs are met, further to the Ontario Public Service’s Employment Equity 
Program, is a function of the Hospital. Ensuring the health and safety of its patients is also a 
function of the Hospital. 


In our view, in arranging for the complainant’s employment accommodation, the Hospital was 
required to consider the needs of both its employee and its patients. As Medical Director, the 
Director had a duty to ensure that the complainant’s accommodation needs could be met with 
maximum possible assurance of the removal of risk to her health and safety on the job, but at 
the same time ensuring that her needs could be met with minimal health and safety risks to the 
Hospital’s patients. It is, therefore, our view that the Director needed to know details and 
particulars of the complainant’s medical condition relating to her accommodation needs and what 
those needs were. The disclosure of the complainant’s personal information was, therefore, to 
an officer who required the information in the performance of his duties and the disclosure was 
necessary and proper in the discharge of the Hospital’s functions. Therefore the disclosure was 
in compliance with section 42(d) of the Act. 


Conclusions: The disclosure of the complainant’s personal information was in 
compliance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The disclosure of the complainant’s personal information was in compliance with section 


42 of the Act. 


RECOMMENDATION 


Although we have concluded that the disclosure of the complainant’s personal information was 
in compliance with the Act, we note that the complainant was unaware that the Hospital, in 
arranging for her employment accommodation needs, had consulted the Director, until she 
received a copy of his memorandum about the consultation. The complainant was unaware that 
the Director had a duty of assisting the Hospital by ensuring that her needs could be met while 
at the same time, ensuring minimal health and safety risks to patients. - 


Therefore, we recommend that the Ministry take steps to ensure that the Hospital’s procedures 
for processing an application for employment accommodation, or for adjusting existing 
accommodation arrangements, clearly set out to whom and for what reason(s), the employee’s 
personal information may be disclosed. 
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Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed By: February 6, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Economic 
Development and Trade (the Ministry). 


The complainant had applied for a loan under the “New Ventures" program which is 
administered by the Ontario Development Corporation, an agency of the Ministry. Under the 
program, personal loans are provided, up to a certain maximum, for eligible small businesses. 
Applicants are required to complete an application form before the Ministry can process the 
request for a loan. The application form asks the applicant to give his/her Social Insurance 
Number (SIN). 3 


The complainant objected to the Ministry’s collection of her SIN on the application form and 
complained that the collection was contrary to the Freedom of Information and Protection of 


Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the complainant’s SIN "personal information", as defined in section 2(1) of 
the Act? If yes, 


(B) Was the Ministry’s collection of the complainant’s SIN in compliance with section 


38(2) of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the complainant’s SIN "personal information", as defined in section 2(1) 
of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including, 


(c) any identifying number, symbol or other particular assigned to the 
individual, . 


It is our view that the SIN is information which meets the requirements of paragraph (c) of the 


‘ definition of "personal information", in section 2(1) of the Act. 
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Conclusion: The complainant’s SIN was personal information, as defined in section 
2(1) of the Act. 


Issue B: Was the Ministry’s collection of the complainant’s SIN in compliance with 
section 38(2) of the Act? 


Section 38(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. [emphasis added]. 


The Ministry submitted that its collection of the SIN was necessary to the proper administration 
of a lawfully authorized activity. In support of its position, the Ministry stated that the 
Development Corporations Act, R.S.O. 1990, c.D. 10, s.12 and 13 and the Ministry of Industry 
and Trade Act, R.S.O. 1990, c.M. 27, s.3 and 6 provide for the creation and administration of 
programs such as the New Ventures program. 


We examined the legislation cited. Section 12 of the Development Corporations Act sets out 
the objects of development corporations which include the "provision of financial assistance by 


loan: 


Section 13 sets out the powers of development corporations which include the lending of “money 
to a person carrying on any industrial undertaking in Ontario..." 


Sections 3 and 6 of the Ministry of Development and Trade Act provides for the promotion of 
the establishment and growth of industry and trade in Ontario; the development and 
administration of programs as appropriate; and the provision of financial assistance and 
incentives. . 


It is our view, therefore, that the administration of the New Ventures program is a “lawfully 
authorized activity" within the meaning of section 38(2) of the Act. 


The Ministry stated that in order to be eligible for assistance under the New Ventures program, 
applicants must meet certain criteria. The two criteria of particular importance are 1) the 
applicant must be either a Canadian citizen or a landed immigrant and 2) he/she cannot have 
received previous assistance under the program. 


The Ministry submitted that by verifying the authenticity of an applicant’s SIN (through a 
mathematical formula), program staff are able to confirm that the applicant is either a Canadian 
citizen or a landed immigrant. 


The Ministry also stated that the authenticated SIN is then used to verify that the applicant has 
not previously been granted a New Ventures loan. The applicant’s SIN is checked against 
existing SIN information in the program’s data bases. The Ministry submitted that no other 
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information collected from the applicant is sufficiently unique to allow the Ministry to ensure 
that an applicant has not already received assistance. 


It e Our view that an applicant’s submission of a valid SIN would not necessarily be verification 
that he/she is a Canadian citizen or a landed immigrant. We are not persuaded that the SIN is 
necesary for this purpose, as other documentation such as a birth certificate, citizenship papers, 
a landing record etc. could be used to verify such status. 


We accept, however, the Ministry’s position that the SIN is necessary for the purpose of 
verifying that an applicant has not previously received assistance under the New Ventures 
program. Thus, it is our view that the Ministry’s collection of the complainant’s SIN for this 
purpose was necessary to the proper administration of the New Ventures program. Therefore, 
the Ministry’s collection of the complainant’s SIN for this purpose was in compliance with 
section 38(2) of the Act. 


Conclusion: The Ministry’s collection of the complainant’s SIN for the purpose of 


verifying if she had received a previous loan under the New Venture 
program was in compliance with section 38(2) of the Act. 


OTHER MATTERS 


Notice of Collection 
Section 39(2) of the Act states that: 


Where personal information is collected on behalf of an institution, the head shall, 
unless notice is waived by the responsible minister, inform the individual to 
whom the information relates of, 


(a) the legal authority for the collection; 


(b) the principal purposes for which the personal information is intended to 
be used; and 


(c) the title, business address and business telephone number of a public 
official who can answer the individual’s questions about the collection. 


During the course of our investigation, we examined the application form for a loan under the 
New Ventures program. The application form provides the following notice: 


Any personal information contained in this, or any subsequent forms attached or 
forwarded at a later date, is received under the authority of Section 12 of the 
Development Corporations Act, R.S.O 1980, C.117 as amended, and Sections 3, 
6, & 11 of the Ministry of Industry and Trade Act, S.O. 1982, C.31 and will be 
used to provide a data base of borrowers registered in the New Ventures loan 
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program, to ensure that borrowers receive only one loan and that statistical 
information on the program is recorded. 


It is our view that the notice on the application form satisfies sections 39(2)(a) and (b) but not 
section 39(2)(c) of the Act. 


Conclusion: The Ministry did not provide proper notice of its collection, in compliance 
with section 39(2) of the Act. 


SUMMARY OF CONCLUSIONS 

e The complainant’s SIN was personal information, as defined in section 2(1) of the Act. 

e The Ministry’s collection of the complainant’s SIN for the purpose of verifying if she had 
received a previous loan under the New Ventures program was in compliance with 


section 38(2) of the Act. 


e The Ministry did not provide proper notice of its collection, in compliance with section 
39(2) of the Act. 


RECOMMENDATIONS 


We recommend that the Ministry: 


l. collect the SIN only for the purpose of verifying that an applicant has not previously 
received a loan; 


ab amend the notice on the application form to ensure that it complies with section 39(2) of 
the Act. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Orginal signed by: December 7, 1994 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a Police Services Board 
(the Board). 


The complainant was a police constable with the Board. The complainant had filed a complaint 
with the Board against the Chief of Police (the Chief). The complainant’s wife simultaneously 
filed a complaint against the Chief with the local office of the Police Complaints Commissioner 
(the PCC). The Police Services Act (PSA) authorizes the Board to administer the public 
complaints system. Therefore, the PCC forwarded the wife’s complaint to the Board. 


The Chief rendered a decision with respect to the wife’s complaint. In his decision letter to the 


complainant’s wife, the Chief stated ‘that "I am also aware of a complaint against myself that has 


been initiated by your husband...". The complainant was concerned that this disclosure of his 


personal information to his wife was not in compliance with the Municipal Freedom _of 
Information and Protection of Privacy Act (the Act). 


The complainant also stated that the Chief’s decision letter regarding his wife’s complaint, which 
contained his personal information, was forwarded to the PCC. The complainant believed that 
this additional disclosure was not in compliance with the Act. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) | Was the complainant’s personal information disclosed to his wife in compliance 
with section 32 of the Act? 


(C) | Was the complainant’s personal information disclosed to the PCC in compliance 
with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) states, in part: 
"personal information" means recorded information about an identifiable 


individual, including, 
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(h) the individual’s name if it appears with other personal information 
relating to the individual or where the disclosure of the name 
would reveal other personal information about the individual; 


The information in question was the complainant’s name together with the fact that he had filed 
a complaint against the Chief with the Board. In our view, this information met the requirements 
of paragraph (h) of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information in question was personal information, as defined in 
section 2(1) of the Act. 


Issue B: Was the complainant’s personal information disclosed to his wife in 
compliance with section 32 of the Act? 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 32. The Board has relied 
upon section 32(e) of the Act for the disclosure of the complainant’s personal information. 
Section 32(e) states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature 
or an Act of Parliament, an agreement or arrangement 
under such an Act or treaty; 


The Board informed us that the complainant’s wife had filed a public complaint with the PCC 
against the Chief under section 77(1)(b) Part VI, of the PSA. 


The Board further informed us that section 41(1)(e) of the PSA states that the duties of a Chief 
include administering the public complaints system under Part VI of the PSA and, consequently, 
the complainant’s wife’s complaint had been forwarded to the Chief. The Board informed us 
that the Chief found the wife’s complaint to be vexatious in nature, and made in bad faith. The 
Chief directed that no further action be taken. The Board maintained that this decision was 
made by the Chief in accordance with section 85(1) of the PSA, which states: 


At any time before making a decision under section 90, the chief of police may 
decide that the complaint or part of it shall not be further dealt with under this 
Part, if he or she is of the opinion that the complaint or part is frivolous or 
vexatious or was made in bad faith. 


The Board submitted that it disclosed the complainant’s personal information in order to comply 
with section 85(2) of the PSA, which states: 


The chief of police shall give the Commissioner [PCC], the complainant and the 
police officer notice of the decision. 


{IPC Investigation 194-057M\March 16, 1995] 


[3h 


The Board maintained that it is customary for the Chief to give the reasons behind his decision 
in the "notice of the decision". The Board stated that the fact that the complainant had made 
a complaint against the Chief was part of the evidence used to reach a conclusion with respect 
to the wife’s complaint. The Board maintained that it was proper and fair to inform the wife 
of the relevant factors considered in ruling her complaint vexatious. Thus, the Board submitted 
that the disclosure of the complainant’s personal information to the wife, as one of the relevant 
factors in the Chief’s decision, was in compliance with section 32(e) of the Act. 


It is our view that the word "complying" in section 32(e) of the Act means that there must be 
a specific requirement for the disclosure in question. Under section 85(2) of the PSA, the Chief 
was required to provide notice of his decision but not specifically to disclose the complainant’s 
personal information to his wife. It is, therefore, our view that since the Chief’s disclosure was 
not for the purpose of complying with an Act of the legislature, section 32(e) of the Act did not 
apply in the circumstances of this case. 


We have examined the remaining provisions of section 32 of the Act. It is our view that none 
applied to the disclosure of the complainant’s personal information to his wife. 


Conclusion: The disclosure of the complainant’s personal information to his wife was 
not in compliance with section 32 of the Act. 


Issue C: Was the complainant’s personal information disclosed to the PCC in 
compliance with section 32 of the Act? 


The Board has relied upon sections 32(f) and (g) of the Act for the disclosure of the 
complainant’s personal information to the PCC. Section 32(f) and (g) state that an institution 
shall not disclose personal information in its custody or under its control except: 


(f) if disclosure is by a law enforcement institution, 


(i) to a law enforcement agency in a foreign country under an 
arrangement, a written agreement or treaty or legislative authority, 
or 


(ii) | to another law enforcement agency in Canada; 


(g) if disclosure is to an institution or a law enforcement agency in Canada to 
aid an investigation undertaken with a view to a law enforcement 
proceeding or from which a law enforcement proceeding is likely to 
result; 


In order for section 32(f) of the Act to apply, the disclosure must be by a law enforcement 


institution to a law enforcement agency in Canada. Section 2(1) of the Act sets out the definition 
of "law enforcement” as: 
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(a) policing, 


(b) investigations or inspections that lead or could lead to proceedings in a 
court or tribunal if a penalty or sanction could be imposed in those 
proceedings, and 


(c) the conduct of proceedings referred to in clause (b); 


The Board is an institution involved in activities which include policing and investigations or 
inspections that lead or could lead to proceedings in a court or tribunal where penalties or 
sanctions could be imposed. It is our view that these are law enforcement activities and that the 
Board is, thus, a law enforcement institution. 


In Order P-659, Inquiry Officer Donald Hale examined whether an investigation undertaken by 
the PCC qualified as a "law enforcement investigation" within the meaning of section. 14(2)(a) 
of the Act. In this Order, he states: 


In its representations, the Ministry claims that the PCC has the statutory authority 
to call a Board of Inquiry to adjudicate on the substance of allegations of police 
misconduct. The Board of Inquiry is empowered under the Police Services Act 
to impose penalties or sanctions on officers found to have engaged in unlawful 
conduct. 


The Ministry indicates and I accept that the investigation which resulted in the 
creation of the record at issue could have led to a Board of Inquiry hearing and 
possible penalties or sanctions against the officers named in the complaint...the 
report was prepared in the course of a law enforcement investigation. 


Inquiry Officer Hale also stated: 


In Order P-416, Assistant Commissioner Tom Mitchinson addressed the 
application of section 14(2)(a) of the Act to a number of records created by the 
PCC. He stated that: 


In my view, in order for a record created by the PCC to qualify 
for consideration under either sections 14(1) or (2) of the Act, the 
PCC must establish that it has a law enforcement mandate ... 


The record at issue in this appeal relates directly to the PCC’s mandate to 
investigate possible infractions of the Police Services Act. I also find that, for 
the purposes of section 14(2)(a), the PCC qualifies as a "law enforcement 
tribunal" which has the function of enforcing compliance with a law, in 
particular, the Police Services Act... 
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It is our view that once a member of the public makes a complaint to the PCC about the conduct 
of a police officer, such a complaint could result in a disciplinary hearing under section 60 of 
the PSA, a hearing by a board of inquiry, or cause an information to be laid against the police 
officer and the matter referred to the Crown Attorney for prosecution. The complaint could, 
therefore, result in penalties and sanctions against the officer named in the complaint. 


Thus, it is our view that the PCC has a law enforcement function and can be considered to be 
a law enforcement agency. Accordingly, the disclosure of the complainant’s personal 
information by a law enforcement institution, the Board, to the PCC, a law enforcement agency, 
was in compliance with section 32(f) of the Act. 


In light of the above, it is not necessary for us to examine section 32(g) or the remaining 
provisions of section 32 of the Act. 


Conclusion: The Board’s disclosure of the complainant’s personal information to the 
PCC was in compliance with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


® The information in question was personal information, as defined in section 2(1) of the 
Act. 
e The disclosure of the complainant’s personal information to his wife was not in 


compliance with section 32 of the Act. 


e The Board’s disclosure of the complainant’s personal information to the PCC was in 
compliance with section 32 of the Act. 


RECOMMENDATION 


We recommend that the Board take steps to ensure that all Board employees are aware of the 
disclosure provisions in the Act. For example, all staff members who handle personal 
information should be reminded in writing of the limited circumstances under which the 
disclosure of personal information is permitted. 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed by: March 16, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Municipal 
Affairs (the Ministry). 


The complainant had been involved with an appeal to the Ontario Municipal Board (the OMB) 
of a zoning by-law, in a particular town (the Town). Sometime later, the complainant sent a 
letter to the Minister of Municipal Affairs (the Minister), by facsimile, complaining about the 
conduct of the Interim Chair of the OMB and requesting that the Ministry investigate the OMB’s 
handling of the appeal. 


The complainant stated that although his facsimile cover sheet to the Minister was clearly 
marked "confidential," the Minister had nonetheless disclosed his letter in its entirety to the 
Interim Chair who was, "the official about whom I was complaining." The complainant 
provided us with a copy of the Minister’s reply, in which he stated: "... I have noted your 
concerns and have forwarded a copy of your letter and my response to (the named Interim 
Chair), for his attention." The complainant believed that this disclosure of his personal 
information had contravened the Freedom of Information and Protection of Privacy Act (the 
Act). 


The complainant also provided us with a copy of a facsimile cover sheet which an employee of 
the Ministry had sent to an employee of the Town. In the "Comment" section, the Ministry 
employee had stated: "As per your request, I have attached a copy of our Minister’s recent 
response to (the named complainant) regarding an OMB matter. I have also attached (the named 
complainant’s) letter." The complainant felt that this disclosure had also violated the Act. 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the complainant’s personal information disclosed to the Interim Chair of the 
OMB, in compliance with section 42 of the Act? 

(C) Was the complainant’s personal information disclosed to the Town, in compliance 
with section 42 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) states, in part: 


"personal information” means recorded information about an _ identifiable 
individual, including, 


(c) any identifying number, symbol or other particular assigned to the 
individual, 


(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(e) the personal opinions or views of the individual except where they relate 
to another individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


The complainant’s letter to the Minister and the Minister’s reply contained the following 
information about the complainant: his name, address and telephone number, his OMB file 
numbers, the fact that he had requested the Ministry to investigate the OMB’s handling of the 
zoning matter, reference to a letter that the Interim Chair had written to the complainant and 
another individual, the complainant’s view that the OMB had mismanaged this case, and the fact 
that the complainant’s letter constituted a formal complaint regarding the conduct of the OMB’s 
Interim Chair. 


In our view, this information met the requirements of paragraphs (c), (d), (e) and (h) of the 
definition of "personal information” in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 
Issue B: Was the complainant’s personal information disclosed to the Interim Chair 
of the OMB, in compliance with section 42 of the Act? 
Under the Act, personal information in the custody or under the control of an institution cannot 


be disclosed except in the specific circumstances outlined in section 42. 


[IPC Investigation 194-064P/May 2, 1995] 


=e 


The Ministry stated that section 42(c), disclosure for a consistent purpose, supported its 
disclosure to the OMB’s Interim Chair since the OMB was in the best position to respond to the 
allegations raised in the complainant’s letter. 


The complainant stated, however: “I never expected, in writing the letter to the Minister, that 
he would send that same letter to the person who was the subject of my complaint." 


Section 42(c) of the Act states that an institution shall not disclose personal information in its 
custody or under its control except "for the purpose for which it was obtained or compiled or 
for a consistent purpose" (emphasis added). 


Section 43 of the Act further provides that: 


Where personal information has been collected directly from the individual to 
whom the information relates, the purpose of a use or disclosure of that 
information is a consistent purpose under clauses 41(b) and 42(c) only if the 
individual might reasonably have expected such a use or disclosure. 


In our view, the Ministry obtained or compiled the complainant’s personal information for the 
purpose of dealing with his complaint. 


It is also our view that in order for a complaint to be fairly and properly dealt with, the person 
complained about must be advised of what they are accused of, and by whom, to enable them 
to address the validity of the complaint. The complainant must also be informed of the direct 
response to the allegations. 


Therefore, in this particular case, the Interim Chair needed to be given an opportunity to 
respond to the allegations made against him, thus necessitating the disclosure of the 
complainant’s personal information. And, notwithstanding the complainant’s assertion that he 
never expected the Minister to disclose his letter to the Interim Chair, it is our view that an 
individual in these circumstances might reasonably expect such a disclosure of their personal 
information, for the proper handling of their complaint. It is thus our view that the Ministry 
disclosed the complainant’s personal information to the Interim Chair for a consistent purpose, 
in compliance with section 42(c) of the Act. 


Conclusion: The complainant’s personal information was disclosed to the Interim Chair 
of the OMB in compliance with section 42 of the Act. 


Issue C: Was the complainant’s personal information disclosed to the Town, in 
compliance with section 42 of the Act? az 


The Ministry submitted that because the appeal to the OMB involved the Town, and because it 
was possible that the Town “had other dealings with the Ministry on this or related matters, or 
otherwise had relevant information," the Ministry employee had contacted the Town "to obtain 
further information." 
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The Ministry further submitted that without the complainant’s identity, the Town would not 
necessarily have been able to provide the very information that the Ministry needed. The 
Ministry stated that information that the complainant had submitted to the Town regarding the 
matter before the OMB "... might be relevant to the conduct of the chair of the OMB, and 
therefore to any answer the Ministry employee would make to the Minister." 


The Ministry concluded that the complainant could reasonably have expected that it would have 
disclosed his name "... to those with potentially relevant information, and therefore disclosure 
was a ‘consistent disclosure’ within the meaning of s. 43." 


As previously cited, under section 42(c) of the Act, an institution shall not disclose personal 
information in its custody or under its control except, "for the purpose for which it was obtained 
or compiled or for a consistent purpose." Section 43 of the Act further provides that a 
disclosure of information is for a consistent purpose only if the individual might reasonably have 
expected such a disclosure. 


As we Stated in Issue B, it is our view that the Ministry obtained or compiled the complainant’s 
personal information for the purpose of dealing with his complaint. Since the complaint 
specifically concerned the OMB’s conduct in the matter of the appeal and not the Town’s 
involvement, we are not persuaded that, in these circumstances, the complainant might 
reasonably have expected that the Ministry would contact the Town for information that "might" 
be relevant to the Ministry’s inquiry into his complaint. Accordingly, it is our view that the 
Ministry’s disclosure of the complainant’s personal information to the Town was not for a 
consistent purpose in compliance with section 42(c) of the Act. 


We reviewed the remaining provisions of section 42 and found that none applied in the 
circumstances of this complaint. 


Conclusion: The disclosure of the complainant’s personal information to the Town was 
not in compliance with section 42 of the Act. 
Other Matters 
Facsimile Transmission of the Complainant’s Personal Information 
Since this complaint concerned the disclosure of the complainant’s personal information to the 
Town via facsimile, we wish to remind the Ministry of our facsimile transmission guidelines. 
Accordingly, we enclosed with our draft report a copy of the following documents: "Guidelines 


on Facsimile Transmission Security, June 1989," and "Update on the 1989 Guidelines on 
Facsimile Transmission Security, June 1990." 
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SUMMARY OF CONCLUSIONS 


The information in question was “personal information” as defined in section 2(1) of the 
Act. 


The complainant’s personal information was disclosed to the Interim Chair of the OMB 
in compliance with section 42 of the Act. 


The disclosure of the complainant’s personal information to the Town was not in 
compliance with section 42 of the Act. 


RECOMMENDATIONS 


We recommend that the Ministry take steps to ensure that personal information is disclosed only 
in compliance with section 42 of the Act. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 


recommendation. 
Original signed by: May 2, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 


wR 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the 
Attorney General (the Ministry). 


The complainant was employed at a Regional Centre of the Ministry of Community and Social 
Services (MCSS). He was a "surplus" employee and was involved in the Ontario government’s 
redeployment process. As a part of this process, Management Board Secretariat matched the 
complainant’s employment "profile" with respect to a vacancy and sent it to the Ministry’s 
Human Resources Branch. The Branch in turn faxed the complainant’s profile and that of 
another individual to the Court Services Manager at a named Ministry courthouse for his 
consideration. 


According to the complainant, an employee at the courthouse subsequently disclosed to staff at 
the Regional Centre that she had read the faxed materials, and that the complainant and the other 
individual had secured positions with the courthouse through the redeployment process. 


When the complainant became aware of this disclosure, he contacted the appropriate staff in the 
Redeployment Unit at the Regional Centre. They did not know about the match. A few days 
later, however, it became apparent that the complainant was being considered for a position at 
the courthouse. 

The complainant was concerned that the Ministry employee had disclosed his personal 
information contrary to the provisions of the Freedom of Information and Protection of Privacy 
Act, (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) | Was the Ministry’s disclosure of the personal information in compliance with 
section 42 of the Act? 


(C) Did the Ministry take reasonable measures to prevent unauthorized access to 
records? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section ( 
2(1) of the Act? ( 


Section 2(1) of the Act defines "personal information", in part, as: 
recorded information about an identifiable individual, including 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


The information in question included the complainant’s profile containing his name together with 
other information about him, and the information that he was being considered for assignment 
with the Ministry. It is our view that this information met the requirements of paragraph (h) of 
the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information was the complainant’s personal information, as defined 
in section 2(1) of the Act. 


Issue B: | Was the Ministry’s disclosure of the personal information in compliance with 
section 42 of the Act? ( 


Section 42 of the Act sets out the conditions for the disclosure of personal information. This 
section provides that an institution shall not disclose personal information in its custody or under 
its control except in specific circumstances. (The full text of section 42 is given in Appendix A.) 


The Ministry informed us that the appropriate Regional Director for courts administration had 
initiated an internal investigation to address the complainant’s concerns about the disclosure of 
his personal information by a named Ministry employee. 


The Ministry stated that the employee, who the complainant believed had disclosed his personal 
information to MCSS Regional Centre staff, was the local union steward. The Ministry found 
that she had become involved when she had been told by courthouse staff about the contents of 
the fax. She had then discussed with the Court Services Manager, the staff’s concerns that their 
jobs might be "threatened" by the proposed assignments. 


The Ministry concluded in its internal investigation that it was "likely that the disclosure of the 
information regarding the assignment of the surplus staff may have originated from the 
courthouse, however, the actual source is unidentifiable due to conflicting statements of those 
questioned" during its investigation. The Ministry also stated that it was also evident that "the 
disclosure of personal information by the courthouse staff resulted in an unjustified invasion of 
the personal privacy of the complainant." 
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Having considered the information provided by the complainant and the Ministry, it is our view 
that there was a disclosure of the complainant’s personal information by courthouse staff to the 
Ministry employee named by the complainant. It is also our view that there was also a 
disclosure to staff at the MCSS Regional Centre but we are unable to say conclusively that it was 
the named employee who made this disclosure. 


We have examined the provisions of section 42 of the Act, however, and it is our view that none 
were applicable to the Ministry’s disclosures of the complainant’s personal information. 


Conclusion: The Ministry’s disclosures of the complainant’s personal information were 
not in compliance with section 42 of the Act. 


Issue C: Did the Ministry take reasonable measures to prevent unauthorized access to 
records? 


The Ministry found in its internal investigation that its Human Resources Branch had to fax the 
complainant’s profile to the Court Services Manager because the Ministry had only 48 hours to 
review, accept or reject candidates for assignments. The Ministry concluded that the sender 
of the fax, however, did not call ahead to ensure that the addressee would be available or sever 
personal identifiers from the document before it was sent. 


The Ministry also found that the fax machine at the court house was accessible to all courthouse 
staff. In this case, although the fax was addressed to the Court Services Manager, employees 
in the courthouse apparently had access to and knew of the information contained in the fax 
before the Manager did. The Ministry informed us that "unofficial" word spread that the 
complainant and the other individual had received assignments to the courthouse. 


The Ministry stated that it was evident that "personal information about an individual was faxed 
to the courthouse by the Human Resources Branch of the Ministry and necessary pera 
were not taken before the information was faxed." 


Section 4(1) of Regulation 460 under the Act states: 


Every head shall ensure that reasonable measures to prevent unauthorized access 
to records in his or her institution are defined, documented and put in place, 
taking into account the nature of the records to be protected. 


We were informed by the Ministry that there was only one fax machine at the courthouse, 
located in a central, open area accessible to all courthouse staff and that any one of the 
courthouse staff could take incoming correspondence from the fax machine. 


Our office’s "Guidelines on Facsimile Transmission Security" provides information on security 
measures for the transmission of faxes. It advises, for example, that one person should be 
identified as responsible for all fax operations. The fax machine should be located so that it is 
not in a public area, its use can be monitored by the responsible person, and only authorized 
staff can have access to the information transmitted on the fax. 
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The Ministry did not have these or any other measures to prevent unauthorized access to faxed 
documents. It is our view, therefore, that the Ministry did not ensure that reasonable measures 
were defined, documented and put in place to prevent unauthorized access to records, in 
compliance with section 4(1) of Regulation 460. 


Conclusion: The Ministry did not take reasonable measures to prevent unauthorized 
access to records. 


SUMMARY OF CONCLUSIONS 


e The information was the complainant’s personal information, as defined in section 2(1) 
of the Act. 
e The Ministry’s disclosures of the complainant’s personal information were not in 


compliance with section 42 of the Act. 


e The Ministry did not take reasonable measures to prevent unauthorized access to records. 
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RECOMMENDATIONS 


The Ministry informed us that it planned to implement the following measures to ensure that 
similar disclosures did not occur in future. 


- To conduct a training and awareness session at the courthouse to ensure that staff are 
aware of and understand the privacy provisions of the Act, in carrying out their 
responsibilities. 


- To develop internal privacy guidelines to reinforce the responsibilities of staff in terms 
of privacy. 


- To review the fax procedures at the courthouse and make necessary changes to deal with 
the receipt and distribution of incoming faxes which contain personal information. 


- To review our office’s "Guidelines on Facsimile Transmission Security" with the 
courthouse staff. 


In addition, the Ministry advised that the Human Resources Branch had already implemented a 
procedure to telephone and notify the intended recipient ahead of time, if personal information 
was being faxed. In conjunction with this procedure, the fax sheet had been amended to clearly 
note "PERSONAL AND CONFIDENTIAL". 
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We, therefore, recommend that the Ministry implement its planned measures to prevent similar 
improper disclosures of personal information in future. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Onginal Signed by: January 4, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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APPENDIX A 


42. An institution shall not disclose personal information in its custody or under its control 


except, 
(a) 
(b) 


(c) 
(d) 


(e) 


(f) 


(g) 


(h) 


(i) 


() 


in accordance with Part II; 


where the person to whom the information relates has identified that information 
in particular and consented to its disclosure; 


for the purpose for which it was obtained or compiled or for a consistent purpose; 


where disclosure is made to an officer or employee of the institution who needs 
the record in the performance of his or her duties and where disclosure is 
necessary and proper in the discharge of the institution’s functions; 


for the purpose of complying with an Act of the Legislature or an Act of 
Parliament or a treaty, agreement or arrangement thereunder; 


where disclosure is by a law enforcement institution, 
(i) | to a law enforcement agency in a foreign country under an arrangement, 
a written agreement or treaty or legislative authority, or 


(ii) to another law enforcement agency in Canada; 


where disclosure is to an institution or a law enforcement agency in Canada to aid 
an investigation undertaken with a view to a law enforcement proceeding or from 
which a law enforcement proceeding is likely to result; 


in compelling circumstances affecting the health or safety of an individual if upon 
disclosure notification thereof is mailed to the last known address of the © 
individual to whom the information relates; 


in compassionate circumstances, to facilitate contact with the next of kin or a 
friend of an individual who is injured, ill or deceased; 


to a member of the Legislative Assembly who has been authorized by a 
constituent to whom the information relates to make an inquiry on the 
constituent’s behalf or, where the constituent is incapacitated, has been authorized 
by the next of kin or legal representative of the constituent; 
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(k) 


(1) 
(m) 
(n) 


to a member of the bargaining agent who has been authorized by an employee to 
whom the information relates to make an inquiry on the employee’s behalf or, 
where the employee is incapacitated, has been authorized by the next-of-kin or 
legal representative of the employee; 

to the responsible minister; 


to the Information and Privacy Commissioner; and 


to the Government of Canada in order to facilitate the auditing of shared cost 
programs. 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a Board of Education (the 
Board). The grade nine class attended by the complainant’s child had been assigned a project 
entitled "Connections Portfolio" (the Project). To complete the Project, students were required 
to disclose personal information relating to their ancestry, race, and country of origin and that 
of their family members. 


When the complainant made his concerns about the Project known to the Board, the Board 
advised him that his child could complete an alternative project, which would not contain any 
personal information. However, the complainant rejected this option as he felt his child might 
be singled out, or risk harassment from other students if his child did not complete the same 
project as the other students. The complainant stated that he had advised his child to make up 
false information in order to complete the Project without disclosing personal information. 


The complainant stated that the Board’s collection of the personal information requested in the 
Project demonstrated a lack of sensitivity to ethnic and civil liberties issues, and was a violation 


of the privacy nights protected by the Municipal Freedom of Information and Protection of 
Privacy Act (the Act). 

Issues Arising from the Investigation 

The following issues were identified as arising from the investigation: 


(A) | Was the information requested for the Project "personal information" as defined 
in section 2(1) of the Act? If yes, 


(B) Was the personal information collected in compliance with section 28(2) of the 
Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information requested for the Project “personal information" as 
defined in section 2(1) of the Act? 


Section 2(1) of the Act defines “personal information" as recorded information about an 
identifiable individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, age, 
sex, sexual orientation or marital or family status of the individual; 


We reviewed a copy of the Project outline. The requested information for the Project included 
information about the student’s and his or her family’s ancestry, place of birth, immigration, and 
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country of origin. In our view, this information was information that met the requirements of 
paragraph (a) of the definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information requested for the Project was personal information as ( 
defined in section 2(1) of the Act. 


Issue B: Was the personal information collected in compliance with section 28(2) of 
the Act? 


Section 28(2) of the Act states that: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added). 


The Board provided us with copies of the common curriculum and the Project outline. The 
Board stated that the Project was developed for the Self and Society program area. The common 
curriculum describes the Self and Society program area as a combination of several traditional 
areas of study, including business studies, family studies, geography, guidance, history, and 
physical and health education. A central goal of the program area is to help students understand 
their society and their possible roles in it. In addition, as students learn about other societies, 
they come to understand and respect the differences between people. Students investigate 
various social, political, economic, and environmental systems, and the ways in which human 
beings depend on each other. ¢ 


The common curriculum further states that in the process, students come to understand their own 
heritage by studying their own historical, cultural, and linguistic background and that the study 
of other cultures helps them value the contributions that diverse groups have made to Canada 
and the world. 


Therefore, the Board submitted that the Project was designed not only to teach traditional 
subjects, but to promote multi-culturalism and a sense of self-worth. The Board further stated 
that it recognized that the program dealt with sensitive issues and as a result, it had offered 
alternative assignments for students. 


The Board submitted, however, that in its view, the Act did not apply in the circumstances of 
this case, partly because the Project was not an assignment from the Board but from a specific 
teacher who returned the assignments to students once they had been assessed and marked. In 
our view, teachers are employees of the Board who assign projects and collect and use students’ 
personal information on these assignments on behalf of the Board. Therefore, the Act was 
applicable. 


The Board submitted that if the Act did apply, then its collection of personal information for the 


Project was in compliance with section 28(2) of the Act, i.e. necessary to the proper 
administration of a lawfully authorized activity. 
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The Board referred us to the Education Act, which allows it to design and teach courses of 
study such as the Project, under the mandate of the Ministry of Education and Training (MET). 
The Project was based on MET guidelines as an integrated unit for all grade 9 students. 


The Board referred us to the following provisions of the Education Act: 
Section 8(1), paragraph 2: 
The Minister may: 


prescribe the courses of study that shall be taught and the courses of study 
that may be taught in the primary, junior, intermediate and senior 
divisions; 


Section 171(1), paragraph 8 gives further authority for a board to: 


provide instruction in courses of study that are prescribed or approved by 
the Minister,- developed from curriculum guidelines issued by the Minister 
or approved by the board where the Minister permits the board to approve 
courses of study; 


In our view, the following provision of the Education Act also applies: 
Section 170, paragraph 6: 
Every board shall: 


provide instruction and adequate accommodation during each 
school year for the pupils who have a right to attend a school 
under the jurisdiction of the board. 


In our view, the above provisions of the Education Act set out the Board’s authority to provide 
instruction in courses of study for students that are developed from the common curriculum 
guidelines issued by the Minister. 


The complainant disagreed that the Board acted in accordance with the guidelines set out by the 
MET. He contended that the MET had not set guidelines for the incorporation of 
multiculturalism into the curriculum. It is our view, however, that since the guidelines do not 
sanction actual course content, the Board had not contravened the MET guidelines by assigning 
a multicultural component to the Project. 


Thus, it is our view that in this case, the Board’s assignment of projects, as part of providing 
instruction in a course of study for students, was a lawfully authorized activity. Further, it is 
our view that the personal information requested for the Project was necessary in order to 
properly administer the Project, i.e. for the assignment to be completed and students evaluated. 
Therefore, the Board’s collection of personal information was necessary to the proper 
administration of a lawfully authorized activity, in accordance with section 28(2) of the Act. 
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Conclusion: The Board’s collection of personal information for the Project was in 
compliance with section 28(2) of the Act 


SUMMARY OF CONCLUSIONS 


e The information requested for the Project was personal information as defined in section 
2(1) of the Act. 


e The Board’s collection of personal information for the Project was in compliance with 
section 28(2) of the Act. 


Original Signed by: March 16, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 


Ps tS 3 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of the 
Attorney General (the Ministry). 


The complainant was employed at a Regional Centre of the Ministry of Community and Social 
Services (MCSS). She had written a letter to the Administrator of the Regional Centre about 
a Ministry employee at a named courthouse. This letter was marked "Private/Confidential" at 
the top. The complainant had also sent copies of the letter by fax to the Ministry’s Regional 
Director and to the Court Services Manager at the courthouse. According to the complainant, 
the employee, who was the subject of her letter, had obtained a copy of the letter, put her own 
name and telephone on it, and had distributed copies of it at the Regional Centre. 

The complainant was concerned that the Ministry’s employee had disclosed her personal 
information contrary to the Freedom of Information and Protection of Privacy Act (the Act). 
Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Ministry’s disclosure of the personal information in compliance with 
section 42 of the Act? 


(C) Did the Ministry take reasonable measures to prevent unauthorized access to 


records? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 


recorded information about an identifiable individual, including 
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(d) the address, telephone number, fingerprints or blood type of the 
individual, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; (emphasis added) 


The information in question was the complainant’s name and her telephone/fax number. It is 
our view that this information met the requirements of paragraphs (d) and (h) of the definition 
of personal information in section 2(1) of the Act. 


Conclusion: The information in question was the complainant’s personal information, 
as defined in section 2(1) of the Act. 


Issue B: Was the Ministry’s disclosure of the personal information in compliance with 
section 42 of the Act? 


Section 42 of the Act sets out the conditions for the disclosure of personal information. This 
section provides that an institution shall not disclose personal information in its custody or under 
its control except in specific circumstances. (The full text of section 42 is given in Appendix 
A.) 


In this case, there were two disclosures: the courthouse staff’s disclosure of the complainant’s 
letter to the named employee and her subsequent disclosure of the letter to staff at the MCSS 
Regional Centre. 


With respect to the first disclosure, the Ministry informed us that an internal investigation had 
been conducted. The Ministry found in its investigation that it was "a fact that a letter marked 
"Confidential/Private" was faxed to the courthouse on a weekend." The Ministry also stated that 
"Because the letter that was faxed did not include a cover sheet, courthouse staff inadvertently 
released the letter to the individual who was the subject of the letter." The Ministry’s position, 
however, was that "the privacy of the complainant was not invaded in this case”. 


It is our view that although there was no cover sheet, the faxed letter from the complainant 
clearly indicated that it was a copy intended for the named "Court House Supervisor" and, 
therefore, staff should have forwarded the letter to him rather than to the employee who was the 
subject of the letter. 


The Ministry also submitted that since the information in the letter was the personal information 
about the employee, if she had made "a request under the FOI Act for access to this record, she 
would likely have been granted access to the document." It is our view that since the employee 
did not make an access request under the Act, whether she would have obtained the record in 
response to such a request is not relevant to the issue of disclosure. 
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We have examined the provisions of section 42 of the Act and it is our view that none were 
applicable to the Ministry’s disclosure of the complainant’s personal information to the employee 
in question. 


With respect to the employee’s subsequent disclosure of the complainant’s personal information 
to staff at the MCSS Regional Centre, the Ministry informed us that the incident occurred during 
an election campaign for the position of president of a local union. The employee, a union 
steward, was one of the candidates. 


The Ministry submitted that in this case, the employee was acting entirely "on her own initiative 
in her capacity as a Union Steward and a private citizen" but not as an employee of the Ministry 
when she distributed copies of the complainant’s letter. 


It is our view that not all acts of government employees may be attributed to the institution that 
employs them. In the circumstances of this particular case, we agree with the Ministry’s 
position that the employee’s action of distributing a letter (containing information about herself) 
to staff of the Regional Centre was not on behalf of the Ministry. Section 42 of the Act applies 
to the disclosures of personal information by institutions. Therefore, in this case, section 42 
was not applicable to the employee’s disclosure of the complainant’s personal information. 


Conclusion: The Ministry’s disclosure of the personal information to the employee was 
not in compliance with section 42 of the Act. 


Section 42 of the Act did not apply to the employee’s subsequent 
disclosure to staff at the Regional Centre. 


Issue C: Did the Ministry take reasonable measures to prevent unauthorized access to 
records? 


Section 4(1) of Regulation 460 under the Act states: 


Every head shall ensure that reasonable measures to prevent unauthorized access 
to records in his or her institution are defined, documented and put in place, 
taking into account the nature of the records to be protected. 


In its representations, the Ministry informed us that the fax machine at the court house, is 
located in a central, open area "which is accessible to all court house staff." We were also 
informed that there is only one fax machine and any one of the court house staff takes incoming 
correspondence from the fax machine. 


Our office’s "Guidelines on Facsimile Transmission Security", provides information on security 
measures for the transmission of faxes. It advises, for example that one person should be 
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identified as responsible for all fax operations. The fax machine should be located such that it 
is not in a public area, its use can be monitored by the responsible person and only authorized 
staff can have access to the information transmitted on the fax. 


The Ministry did not have these or any other measures to prevent unauthorized access to faxed 
documents. It is our view, therefore, that the Ministry did not ensure that reasonable measures 
were defined, documented and put in place to prevent unauthorized access to records, in 
compliance with section 4(1) of Regulation 460. 


Conclusion: The Ministry did not take reasonable measures to prevent unauthorized 
access to records. 
SUMMARY OF CONCLUSIONS 
e The information in question was the complainant’s personal information, as defined in 
section 2(1) of the Act. 


e The Ministry’s disclosure of the personal information to the employee was not in 
compliance with section 42 of the Act. 


Section 42 of the Act did not apply to the employee’s subsequent disclosure to staff at 
the Regional Centre. 


e The Ministry did not take reasonable measures to prevent unauthorized access to 
records. 
RECOMMENDATIONS 


Although it is the Ministry’s position that there was no improper disclosure of the complainant’s 
personal information in this case, it has, nevertheless, reiterated its plans to implement the 
measures it described in investigation I94-67P to ensure that a similar disclosure does not occur 
in future. These are: 


- To conduct a training and awareness session at the courthouse to ensure that staff are 
aware of and understand the privacy provisions of the Act, in carrying out their 
responsibilities. 

- To develop internal privacy guidelines to reinforce the responsibilities of staff in terms 


of privacy. 
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- To review the fax procedures at the courthouse and make necessary changes to deal with 
the receipt and distribution of incoming fax which contain personal information. 


We note, however, that the Ministry did not state that it would also review our office’s 
"Guidelines on Facsimile Transmission Security" with courthouse staff. | We, therefore, 
recommend that the Ministry implement all four measures with reference to the circumstances 
of this case to ensure that no similar improper disclosure occurs in future. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed By: January 3, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a Municipality. The 
complainant’s and the Municipality’s accounts of the circumstances leading up to this complaint, 
however, differed significantly. While these differences have been noted below, the 
Municipality nonetheless acknowledged that it did disclose certain of the complainant’s personal 
information. 


The Municipality stated that one of its Building Inspectors had notified the complainant that he 
was illegally using a property he owned as a four-family dwelling, contrary to the zoning by- 
law. 


The Municipality added that sometime later, the complainant telephoned the Area Manager of 
the Municipality’s Building and Inspections Department (the Department) and asked him to defer 
the issuance of an Order to Comply against his property, further to the infraction, because he 
was considering running for Councillor in the 1994 municipal election, and the issuing of the 
Order might jeopardize his chances. The complainant, however, denied that he (a) telephoned 
the Area Manager, (b) requested a deferral of the work order, and (c) indicated that he was 
planning to run in the election. 


The Municipality stated that the complainant’s request to defer the Order was discussed with 
various officials of the Department, and with the Councillor for that ward (the Councillor). The 
Municipality added that the Area Manager and two Building Inspectors subsequently attended 
the property, and advised the complainant that the Department could not withhold the issuance 
of the Order. The complainant stated that a discussion regarding the Municipality’s inability to 
defer the Order never took place. 


The Municipality stated that sometime later, the Councillor telephoned the Area Manager and 
requested further information about the complainant’s property. The Councillor was advised that 
an active zoning file was being compiled against this property because, although it was zoned 
as residential, a business was being operated from it; that an Order was being issued to the 
owner (i.e., the complainant) listing infractions of the housing by-law; and that a second zoning 
file was being started for the illegal use of this property as a four-family dwelling. 


The complainant stated that the Councillor, who was running for re-election, used the 
information that the Department had disclosed to him in his campaign literature, as follows: 
"The male candidate running against (the named Councillor) in this election contributes to the 
problems in our neighbourhood. He has an illegal four family income property which is in 
disrepair and does not meet the property standards by-law under the building and inspection 
guidelines." 


The complainant stated that the Municipality’s disclosure of this information to the Councillor 
contravened the Municipal Freedom of Information and Protection of Privacy Act (the Act). 
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Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the personal information disclosed to the Councillor, in compliance with 
section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


The information in question was the information disclosed by the Municipality to the Councillor, 
in connection with the complainant’s property. This included "... all details of the request for 
deferral, including who made the request, and the ownership details of the property" (emphasis 
added). "All details" would include that the complainant had allegedly requested that the order 
for non-compliance with the by-law be delayed because of his upcoming candidacy. 


The information in question also included: 


-- that a zoning file was being compiled against the complainant’s property because it was 
a residential building and a business was being operated from it, 

-- that an Order was in the process of being issued to the complainant listing infractions of 
the Municipality’s housing by-law, 

-- that a second zoning file was being started for the illegal use of the property as a four- 
family dwelling, and 

-- the fact that the complainant had been identified as being responsible for the alleged 
unlawful condition of the property. 


The Municipality took the position that "... the information that was provided respecting the 
infractions against the property and outlining the municipal address of the property, does not 
constitute personal information, but rather property information ...". The Municipality cited a 
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number of Orders issued by this Office in support of its position, including Orders M-15 and 
M-176. 


The records at issue in M-15 were copies of work orders which had been issued by a 
municipality against various residential rental properties. Commissioner Tom Wright concluded 
that "... the municipal addresses of the properties in question as well as information concerning 
repairs do not constitute personal information as defined in the Act." 


In M-176, Inquiry Officer Holly Big Canoe stated: "I find that the fact of being identified as 
responsible for the alleged unlawful condition of a property is ’other personal information’ for 
the purposes of subparagraph (h) of the definition ..." 


Based on the above, we concur with the Municipality that the municipal address of the 
complainant’s property and the infractions against it did not constitute "personal information", 
as defined in section 2(1) of the Act. 


However, it is also our view that the complainant’s name together with the fact that he owned 
the property in question, that he had allegedly requested that the order for non-compliance with 
the zoning by-law be delayed because of his upcoming candidacy, and that he was identified as 
being responsible for the alleged unlawful condition of the property met the requirements of 
paragraph (h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The municipal address of the complainant’s property and the infractions 
against it did not constitute "personal information", as defined in section 
2(1) of the Act. 


The complainant’s name together with the fact that he owned the property 
in question, that he had allegedly requested that the order for non- 
compliance with the zoning by-law be delayed because of his upcoming 
candidacy, and that he was identified as being responsible for the alleged 
unlawful condition of the property was "personal information", as defined 
in section 2(1) of the Act. 


Issue B: Was the personal information disclosed to the Councillor, in compliance with 
section 32 of the Act? 


Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 32. 


The Municipality submitted that section 32(c) of the Act permitted the disclosure of the 
complainant’s personal information to the Councillor. Section 32(c) states: “An institution shall 
not disclose personal information in its custody or under its control except ... for the purpose 
for which it was obtained or compiled or for a consistent purpose." 
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Section 33 of the Act further states that: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably 
have expected such a use or disclosure. 


The Municipality explained that the issue of multiple unit dwellings was a controversial matter 
in the area of the complainant’s property. It added that the property in question was a multiple 
unit dwelling, and that the request for a delay related to the complainant’s non-compliance with 
the provisions of the zoning by-law that dealt with multiple unit dwellings. 


The Municipality submitted that the complainant’s name was provided to the Councillor "... in 
order that the Councillor could participate fully in discussions respecting the unusual request for 
a deferral of a Work Order on a property in his Ward." The Municipality further submitted that 
it advises the ward councillor "of any special consideration either being granted or requested in 
respect of a property in his or her Ward, in order that the Ward Councillor can properly deal 
with any enquiries he or she may receive respecting the request under consideration." 


The Municipality also stated that it is the practice of the Buildings and Inspections Department 
to share information concerning building or zoning infractions with the respective ward 
councillor, where, in the judgement of the Area Manager, special circumstances exist or "where 
it anticipates problems." The Municipality stated that, in this case, the special circumstances 
were the complainant’s "forceful demand" that the order for non-compliance be delayed because 
of his upcoming candidacy. According to the Municipality’s Area Manager, the complainant 
stated: "Don’t you dare issue an order against my property.” 


The Municipality added that staff of the Department "were concerned that the complainant would 
also approach the ward councillor, and the staff wished to ensure that the Councillor was aware 
of the potentially controversial situation and the Department’s decision as well as its rationale, 
in the event that he received enquiries." 


The Municipality stated that the Department notified the Councillor "to make him aware of the 
Department’s approach and to ensure consistency in enforcement. The Department is aware that 
many property owners approach their Councillors for assistance, and therefore consistency in 
enforcement was of concern to the Department." 


In summary, therefore, the Municipality’s position is that it disclosed the complainant’s personal 
information because the complainant had requested special consideration with respect to his 
property (i.e., a delay in issuing an order to comply due to his upcoming candidacy), and the 
Councillor needed this information to assist him in dealing with any enquiries he received 
regarding the complainant’s request. The Municipality was also concerned that since many 
property owners approached their Councillor for assistance -- presumably to favourably influence 
their request for special consideration -- consistency in enforcement of the by-law was of 
concern to the Department. 
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In our view, the Municipality would have obtained or compiled the fact that the complainant had 
allegedly requested the Department to delay issuing an order to comply against his property, in 
order to decide whether or not to grant the request, for the ultimate purpose of administering 
its zoning by-law. 


In order for the Municipality’s disclosure of the complainant’s personal information to be in 
compliance with section 32(c) of the Act, the information must have been disclosed either to 
assist the Municipality in deciding whether or not to grant the complainant’s request, or for a 
purpose that was consistent with deciding whether or not to grant the complainant’s request. 
And, since the Municipality collected this information directly from the complainant, a consistent 
purpose is one which the complainant would need to have reasonably expected. 


The Municipality has not provided us with any information demonstrating that the Councillor 
played a role in deciding whether or not to grant a property owner’s request to delay the 
issuance of an order to comply. Thus, it is our view that the Municipality’s disclosure of the 
complainant’s personal information to assist the Councillor in dealing with any enquiries he 
received regarding the complainant’s request was not for the purpose for which it had obtained 
this information. 


The Municipality contended that, in requesting the deferral, "the complainant should reasonably 
expect that all details of such an unusual request would be discussed with officials within the 
Department of Buildings and Inspections and with the Ward Councillor." 


We concur with the Municipality in that the complainant could have reasonably expected that 
the details of his request would have been discussed with officials of the Department, as those 
very officials were the employees of the Municipality responsible for either granting or denying 
the complainant’s request. However, we do not concur with the Municipality that the 
complainant should have reasonably expected that the details of his request would be discussed 
with the Councillor. 


With regard to the complainant’s reasonable expectation of this disclosure, the complainant 
stated: "I am deeply disappointed that the alleged request was being used as a poor excuse to 
leverage the rationale to further discuss the matter with anyone; including (the named 
Councillor)." 


Based on all of the above, it is our view that the Municipality’s disclosure of the complainant’s 
personal information to the Councillor was not in compliance with section 32(c) of the Act. We 
also reviewed the remaining provisions of section 32, and found that none applied. 


Conclusion: The Municipality’s disclosure of the complainant’s personal information 
to the Councillor was not in compliance with section 32 of the Act. 
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SUMMARY OF CONCLUSIONS 


e The municipal address of the complainant’s property and the infractions against it did not 
constitute "personal information", as defined in section 2(1) of the Act. 


The complainant’s name together with the fact that he owned the property in question, 
that he had allegedly requested that the order for non-compliance with the zoning by-law 
be delayed because of his upcoming candidacy, and that he was identified as being 
responsible for the alleged unlawful condition of the property was "personal 
information", as defined in section 2(1) of the Act. 


° The Municipality’s disclosure of the complainant’s personal information to the Councillor 
was not in compliance with section 32 of the Act. 

RECOMMENDATIONS 

We recommend that the Municipality take steps to ensure that personal information is disclosed 


only in accordance with section 32 of the Act. 


Within six months of receiving this report, the Municipality should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original signed by: June 19, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named township (the 
Township). 


An individual complained that the Township had disclosed to the public a copy of an 
Appointment of Voting Proxy containing her personal information. The individual was 
concerned that the disclosure was not in accordance with the provisions of the Municipal 


Freedom of Information and Protection of Privacy Act (the Act). 


The Township acknowledged that it had disclosed all copies of the Appointment of Voting Proxy 
used in the election, to the members of council shortly after the municipal elections. The 
Township advised us that it had allowed the press to photograph some of the copies of the 
Appointment of Voting Proxy, but stated that the press had not published these photographs. 
The Township also advised that the copies of the Appointment of Voting Proxy would have been 
made available to any member of the public who might have asked to see them because, in its 
view, they are public records and thus, section 27 of the Act applied. 


Our office conducted an investigation into the complaint and issued a draft report. In response, 
the Township advised that it was relying on information provided by the Ministry of Municipal 
Affairs (Municipal Affairs) and Municipal World (a publisher of the Appointment of Voting 
Proxy Form). The Township also indicated that it had provided both Municipal Affairs and 
Municipal World with a copy of the draft report. The Township asked that we consider the 
comments it had received from Municipal World and that we consult with Municipal Affairs. 
The views of Municipal Affairs as well as those of the Township and Municipal World have all 
been considered in arriving at our conclusions in this report, along with the views of the 
complainant as expressed in her original letter of complaint. (The complainant has not made any 
representations in response to the draft report.) 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Does the copy of the Appointment of Voting Proxy contain the complainant’s 
"personal information", as defined in section 2(1) of the Act? If yes, 


(B) Does section 27 of the Act apply to the copy of the Appointment of Voting 
Proxy? If no, 


(C) Did the Township disclose the complainant’s personal information in compliance 
with section 32 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Does the copy of the Appointment of Voting Proxy contain the complainant’s 
"personal information", as defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, 


(h) the individual’s name if it appears with other personal information 
relating to the individual or where the disclosure of the name 
would reveal other personal information about the individual; 


The Township takes the position that the information included in the Appointment of Voting 
Proxy does not fall under the definition of "personal information." 


We have examined the Appointment of Voting Proxy form used by the Township during the last 
election. This form enables an individual to appoint another person to vote on his/her behalf 
in a municipal election. Once completed, the Appointment of Voting Proxy contains the 
elector’s name, full address, and the fact that the elector is making an appointment. It would 
also contain the name and address of the individual appointed to act as the elector’s proxy, and 
whether the two individuals are related. 


The complainant advised that she was the person who had been appointed as proxy and that the 
form was completed in full. Although we were unable to examine the actual document in 
question, based on the information before us, we are satisfied that the completed Appointment 
of Voting Proxy would have contained the complainant’s personal information as defined in 
paragraph (h) of the definition of "personal information," in section 2(1) of the Act. 
Conclusion: The completed Appointment of Voting Proxy would have contained the 
complainant’s personal information as defined in section 2(1) of the Act. 
Issue B: Does section 27 of the Act apply to the copy of the Appointment of Voting 
Proxy? 


Section 27 of the Act states: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


"This Part" refers to the privacy provisions contained in Part II of the Act. 
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1. Appointment of Voting Proxy Form - Notations 


The Appointment of Voting Proxy Form is Form 24, prescribed by regulation under the 
Municipal Elections Act (the MEA). The Appointment of Voting Proxy consists of an original 
and a copy. It is our understanding that the Appointment of Voting Proxy is certified by the 
clerk prior to election day, and the individual appointed as the proxy keeps the original which 
he/she later presents on election day in order to obtain a ballot. According to the Township and 
Municipal World, the copy is retained by the clerk, while the original is ultimately placed in the 
ballot box. 


The Township, in arguing that the copy of the Appointment of Voting Proxy is a public record, 
refers to the notation which appears on the bottom of the copy of the form. This notation is not 
part of the form as prescribed by regulation, but has been placed there presumably for 
instructional purposes by the publisher. The notation on the copy reads: 


This form contains personal information collected and maintained specifically for 
the purpose of creating a record available to the general public and is open to 
inspection by any person upon request in the office of the clerk during normal 
office hours. 


We note that the original form also contains a statement which has been placed on the form by 
the publisher. This statement reads: 


This form, once placed in the ballot box in the custody of the clerk, is not open 
to public inspection, except under the order of a judge. Municipal Elections Act, 
R.S.O. 1990, s. 84(1) and s. 105(1). 


As noted above, it is the original Appointment of Voting Proxy which remains with the 
individual. The statement contained at the bottom of the copy would only be seen if the 
individual actually looked at the copy (which presumably the individual would have no need to 
do). Given that the original states that the "form" (presumably in its entirety, not just the 
"original") will not be open to public inspection, and the fact that it is the original which the 
individual retains, it is our view that an individual completing the proxy form would have the 
impression that the information on both the original and the copy of the Appointment of Voting 
Proxy would be held in strictest confidence. 


2s Legislative Provisions of the MEA 
1) Section 105 
Section 105(1) of MEA deals with access to the contents of the ballot box. It reads: 


No person shall be allowed to inspect the contents of a ballot box in the custody 
of the clerk except under the order of a judge. 
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Section 84 outlines what is to be placed in the ballot box: 


The deputy returning officer shall place in the ballot box, the polling lists, the 
packets containing the ballots, and all other documents or packets that served at 
the election, except, 


(a) the original statement; 
(b) the oath of the poll clerk; 


(c) the oath of the person, if any, chosen to deliver the ballot box to 
the clerk. 


It is not disputed that the original Appointments of Voting Proxy are placed in the ballot box. 
However, it is the position of Municipal World that the current wording of section 105 implies 
that copies of voting proxies should be publicly available. 


In its submission, Municipal World argued that based on the difference in wording between 
section 105(1) and earlier legislation, the legislature intended that copies of voting proxies be 
made publicly available. The earlier legislation read: 


No person shall be allowed to inspect any ballot or other document relating to an 
election in the custody of the clerk except under the order of a judge. 


Municipal World posited that since the only change to the section was to delete the reference to 
"other document," it was the intention of the legislature to place documents, other than the 
contents of the ballot box, in the public domain. 


We asked Municipal Affairs to provide us with information respecting the change in wording, 
as well as the general intention of section 105(1). Municipal Affairs stated that the only 
information available respecting the intention of section 105(1) was the following: 


... that the requirement for judicial permission to inspect election documents be 
restricted to the inspection of the actual ballots (Ministry correspondence Nov. 
20 1 9s3)- 


Municipal Affairs further added that: 


The current intention of the section is that public access only be limited in respect 
of the contents of the ballot box. Ballot boxes include items that may need to be 
reviewed as part of the recount or court proceeding and as such their contents 
should not be distributed except by court order. 


Based on the limited information provided, we were unable to conclude that the wording in 
section 105(1) was intended to make copies of the Appointment of Voting Proxy public 
documents. In our view, the deletion of the words "other documents relating to an election" are 
not sufficient to find that copies are intended to be public records. In addition, the information 
provided by Municipal Affairs is not persuasive. According to the excerpted Ministry 
correspondence, the purpose of section 105 is to require court permission only for inspection of 
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ballots. However, the wording of section 105 refers to the "contents of the ballot box" which 
is defined by section 84 to include more than just ballots. 


With respect to Municipal Affairs’ other comment, the Ministry appears to be arguing that 
section 105(1) is intended to protect the contents of the ballot box, as opposed to the actual 
information contained therein. Without more information respecting the purpose of section 
105(1), it is difficult to accept that the same information which is protected and available only 
upon court order should nonetheless be a public record with absolutely no privacy protection. 
In our view, section 105(1) is a strong indicator that the information contained on the copy of 
the Appointment of Voting Proxy is not intended to be a public record, as contemplated by 
section 27. 


2) Section 104 
Part I of the MEA deals with voting procedures and election documents. Proxy voting is 


provided for under Part I, section 73 of the MEA. We note that there is no provision in Part 
I of the MEA respecting access to copies of voting proxies. 


The Township and Municipal Affairs have both referred to section 104(3) of the MEA as support 
for the view that voting proxies should be available to the public. Section 104(3) reads: 


Subject to subsection (1), the clerk shall retain in his or her possession all oaths, 
nominations, qualification documents, statements of the votes cast, and other 
documents relating to an election until the successors to the persons elected at 
such election have taken office, and may then destroy them. R.S.O. 1980, c. 
308, s. 89(2). 


Municipal Affairs has also referred specifically to the list of electors and to section 107 of the 
MEA which prohibits the commercial use and sale of lists of electors. It is our view that the 
analogy between voting proxies and lists of electors is not compelling. Electors lists are posted 
prior to the election pursuant to the MEA and, while they may remain with the clerk under 
section 104(3), the electors list which is inserted in the ballot box on election day indicates 
whether an elector has in fact voted. The situation regarding voting proxies is different in that 
the original and the copy of the voting proxy contain the same identical information. 


The mere fact that the copies of the voting proxies are in the possession of the clerk does not 
make them a public record. We note that an earlier section of the MEA, which stated that 
nomination papers were to remain with the clerk, was amended in 1990 to expressly provide that 
nomination papers are to be open to inspection by a person during the clerk’s normal office 
hours. Thus, it would appear that the legislature felt it was necessary to draft an explicit 
provision in order to provide for access. 


Similarly, Parts II and II of the MEA which deal with election finances, allow for inspection 
of documents by the public. Section 155(1) provides that documents, financial statements, 
reports and declarations filed with the clerk under this Part are public records and may be 
inspected by any person upon request at the office of the clerk during normal office hours. 
Section 199(1) contains a comparable provision. 
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Given the presence of certain express access provisions in the MEA respecting certain 
documents, it is clear that the legislature turned its mind to this issue. Accordingly, in the 
absence of an express access provision respecting access to voting proxy copies, we cannot 
conclude that section 104(3) renders the copies of voting proxies public records. 


3) Section 111 
The Township referred us to the provisions of section 111 of the MEA: 


Under Section 111 of the Municipal Elections Act it states what is to be secret 
including the act of voting. It does not include a listing of documents not 
addressed in Section 84, "What to be placed in ballot box." 


Section 111 of the MEA sets out the basic principle that the act of voting must be conducted in 
secret and prohibits persons from communicating or inducing others to disclose how an elector 
has voted. Section 111 is set out below: 


(1) Every person in attendance at a polling place or at the counting of the 
votes shall maintain and aid in maintaining the secrecy of the voting. 


(2) | No person shall interfere or attempt to interfere with an elector when 
marking his or her ballot paper, or obtain or attempt to obtain at the 
polling place information as to how an elector is about to vote or has 
voted. 


(3) No person shall communicate any information obtained at a polling place ( 
as to how an elector at such polling place is about to vote or has voted. 


(4) No person shall directly or indirectly, induce or attempt to induce an 
elector to show his or her ballot paper after the elector has marked it so 
as to make known to any person how he or she has voted. 


(5) Subject to section 69, an elector shall not show his or her ballot paper, 
when marked, to any person so as to make known how the elector voted. 


(6) No person who has voted at an election shall, in any legal proceeding to 
question the election or return, be required to state how or for whom he 
or she has voted. R.S.O. 1980, c. 308, s. 95. 


It is our view that section 111 of the MEA does not support the view that copies of voting 
proxies should be made public. 


3% Section 53(2) of the Act 
In its original submissions, the Township raised the confidentiality provision in section 67 of the 


provincial Freedom of Information and Protection of Privacy Act. However, the applicable 
legislation in this case is the municipal Act. Section 53(2) of the municipal Act contains the 


following confidentiality provision: C 
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(2) The following confidentiality provisions prevail over this Act: 


ie Section 105 of the Municipal Elections Act. 


Section 53(2) states clearly that section 105 of the MEA prevails over the provisions of the 
municipal Act. However, since copies of the Appointment of Voting Proxy are not placed in 
the ballot box, and only the contents of a ballot box are protected from inspection by section 
105, copies are not covered by section 105; accordingly, section 53(2) does not apply. 


4. All Information on Voter Proxies is Public Information 


The Township advised that all the information contained within the Appointment of Voting 
Proxy was public information obtainable from the Assessment Roll as well as the voters list 
prepared by the Ministry of Finance. 


Similarly, in its submissions, Municipal World wrote that a proxy form constituted an 
amendment to the list of electors -- a document that is in the public domain. Municipal World 
added that the proxy form contained no information about the person(s) for whom the elector 
or representative intended to vote and therefore did not constitute an invasion of privacy 
regarding the secrecy of voting. 


In considering these points we noted that some of the information on the Voting Proxy does not 
appear publicly elsewhere -- the Assessment Roll does not list the electors’ appointing proxies, 
or electees who are appointed proxies. Neither does the voters list prepared by the Ministry of 
Finance contain this information. Therefore, the information at issue is not in fact the same. 


as Electoral Scrutiny 


In response to the draft report, the Township advised that it had consulted with Municipal 
Affairs and Municipal World, since they produced the forms used by the Township. The 
Township stated: 


Upon speaking with representatives from the Ministry of Municipal Affairs, all 
were of the opinion that the proxy vote applications, which remain in the 
possession of the Clerk, were public documents. The main reason for this, they 
believe, is that the municipal elections process is elector regulated and the elector 
must have access to some of the election documents during and immediately after 
the conclusion of the election to ensure compliance with the provisions of the 
election regulations and legislation. 


In its submissions to the draft report, Municipal Affairs wrote: 


Municipal government is structured with an assumption that an informed and 
motivated public will accept responsibility for the enforcement of legislation that 


regulates municipal conduct. The Municipal Elections Act provides for 
enforcement by an elector, with a few exceptions, not by a provincial agency. 
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To facilitate this enforcement it is necessary that relevant election documents be 
available. 


The certified copy of the proxy that remains in the possession of the Clerk is one 
such document that is available for inspection to ensure the integrity of the 
election. In making the proxy form available, it permits the public to scrutinize 
the conduct of the election and provide the necessary checks and balances to the 
process. Only through access to the proxy form can an elector determine whether 
all steps described above have been complied with. 


We share the view that electoral scrutiny is extremely important. However, in our view, there 
are other less intrusive means by which to achieve this objective. As noted earlier, individuals 
may apply to the court under section 105(1) to examine the original voting proxies. Section 
105(1) allows for the inspection of the contents of a ballot box upon the order of a judge. 
Section 105(2) provides that such an order may be made where a judge is satisfied by affidavit 
or other evidence that the inspection is required for the purpose of maintaining a prosecution for 
an offence, or corrupt practice, or of taking proceedings for contesting an election or return. 


In addition, voting proxies can be checked by a scrutineer on election day or by the clerk prior 
to or after the election. Presumably the clerk maintains a list of the voting proxies, since an 
individual can only serve as a proxy once, unless he or she is acting for family members. 


In summary, we are unable to conclude that the information contained in the copies of the voting 
proxies should not be afforded any privacy protection. In reaching this conclusion we could not 
ignore the strict protection given to the same information by section 105(1) of the MEA. This, 
together with the absence of any explicit access provision relating to copies of voting proxies, 
compels us to conclude that section 27 of the Act does not apply. 


Conclusion: Section 27 of the Act does not apply to the copies of the Appointment of 
Voting Proxy. 


Issue C: Did the Township disclose the complainant’s personal information in 
compliance with section 32 of the Act? 


Section 32 of the Act states that an institution shall not disclose personal information except 
under certain specific circumstances. 


Although the Township did not make any submissions under section 32 of the Act, we have 
reviewed the provisions of this section. It is our view that none of the provisions of section 32 


apply. Therefore, the Township’s disclosure was not in compliance with section 32 of the Act. 


Conclusion: The Township’s disclosure of the complainant’s personal information was 
not in compliance with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The completed Appointment of Voting Proxy would have contained the complainant’s 
personal information as defined in section 2(1) of the Act. 
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e Section 27 of the Act does not apply to the copies of the Appointment of Voting Proxy. 


e The Township’s disclosure of the complainant’s personal information was not in 
compliance with section 32 of the Act. © 


RECOMMENDATION 


We recommend that the Township cease disclosing copies of the Appointment of Voting Proxy, 
effective immediately. 


Within six months of receiving this report, the Township should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed by: August 16, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a named public school 
board (the Board). 


The complainant, the parent of a student attending one of the Board’s secondary schools 
complained that a psychological and personality test had been done on her daughter without her 
consent. The complainant stated that the Board, through this psychological and personality test 
had collected her daughter’s personal information which she felt was not necessary and thereby 
may have compromised her daughter’s privacy. 

It was the complainant’s view that the Board’s collection contravened the Municipal Freedom 
of Information and Protection of Privacy Act (the Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Board collect the personal information, in compliance with section 28(2) 
of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information", in part, as: 


"personal information" means recorded information about an identifiable 
individual, including, 


(e) the personal opinions or views of the individual... 


(h) the individual’s name if it appears with other personal information 
relating to the individual or where the disclosure of the name 
would reveal other personal information about the individual; 
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The information in question was information about the complainant’s daughter and her opinions 
as provided on her psychological and personality test. It is our view that this information met 
the requirements of paragraphs (e) and (h) of the definition of "personal information", in section 
2(1) of the Act. 


Conclusion: The information in question was "personal information", as defined in 
section 2(1) of the Act. 


Issue B: Did the Board collect the personal information, in accordance with section 
28(2) of the Act? 


Section 28(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity [emphasis added]. 


The Board stated that psychological and personality testing and the resulting collection of a 
pupil’s personal information was necessary to the proper administration of a lawfully authorized 
activity, namely, the identification of programs and special education programs and services 
appropriate to the learning abilities and needs of the pupil. 


The Board stated that in this case, it had relied on sections 8(3)(a) and (b) of the Education Act 
(the EA), and sections 2(3)(a) and (b) of Regulation 305, under the EA, Special Education 
Identification Placement and Review Committees and Appeals, as its authority to conduct the 
psychological and personality test and to collect the complainant’s daughter’s personal 
information. 


Sections 8(3)(a) and (b) of the EA states: 


(3) Identification programs and special education programs and _ services.--The 
Minister shall ensure that all exceptional children in Ontario have available to 
them in accordance with this Act and the regulations, appropriate special 
education programs and special education services without payment of fees by 
parents or guardians resident in Ontario, and shall provide for parents or 
guardians to appeal the appropriateness of the special education placement, and 
for these purposes the Minister shall, 


(a) require school boards to implement procedures for early and ongoing 
identification of the learning abilities and needs of pupils, and shall 
prescribe standards in accordance with which such- procedures be 
implemented; and 
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(b) in respect of special education programs and services, define 
exceptionalities of pupils, and prescribe classes, groups or categories of 
exceptional pupils, and require boards to employ such definitions or use 
such prescriptions as established under this clause. 


Sections 2(3)(a) and (b) of Regulation 305 states: 


(3) Where a committee is engaged in identifying a pupil as an exceptional pupil or 
in determining the recommended placement of such a pupil, the committee shall 
obtain and consider an educational assessment of the pupil and, 


(a) where the committee determines that a health assessment or a 
psychological assessment or both of the pupil are required to enable the 
committee to make a correct identification or determination in respect of 
the pupil and with the written permission of the parent, obtain, and 
consider a health assessment of the pupil by a legally qualified medical 
practitioner and obtain and consider a psychological assessment of the 


pupil; 


(b) where, in the opinion of the committee, it is practicable so to do, the 
committee shall with the consent of a parent of the pupil, interview the 


pupil. 


The Board stated that some time in 1993, the complainant had requested the Board to conduct 
an assessment on her daughter for the purpose of assisting school personnel in the planning the 
school program for her daughter and to identify any special programs for her. Before 
administering the assessment, the Board obtained a signed consent from the complainant that 
was witnessed and signed by both the principal of the school where the daughter was attending 
at the time and by a special services contact. 


An assessment, i.e., a psychological and personality test was subsequently conducted but the 
complainant’s daughter did not complete the test and therefore, no special programs were 
identified for her. 


It is our view that the administration of student psychological assessment and personality testing 
in order to identify programs and special education programs and services for students in 
accordance with the EA and its regulations was a lawfully authorized activity. 


It is also our view, that in order to make a proper assessment to identify appropriate programs 


and services, it was necessary for the Board to collect students’ personal information through 
the conduct of the psychological assessment and personality testing. 
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Since the complainant’s daughter did not complete the test, the Board did not complete her 
assessment. However, it is our view that the Board’s collection of the complainant’s daughter’s 
personal information in order to identify appropriate programs for her would have been 
necessary to the proper administration of a lawfully authorized activity and was, thus, in 
compliance with section 28(2) of the Act. 


Conclusion: The Board collected the complainant’s daughter’s personal information in 
compliance with section 28(2) of the Act. 


Other matters 


The complainant also believed that there had been a previous psychological testing of her 
daughter without her consent at another of the Board’s schools. Although she had been informed 
in response to an access request that the Board had created a record of a personal questionnaire 
but that this had been destroyed in accordance with its "confidential disposal of personal 
information procedures", the complainant believed that the record was still being maintained and 
that the Board was refusing to disclose this record to her. 


We informed the complainant of the procedures under the Act if she believed that a record in 
response to an access request existed. 


SUMMARY OF CONCLUSIONS 


° The information in question was "personal information", as defined in section 2(1) of the 
Act. 
° The Board collected the complainant’s daughter’s personal information in compliance 


with section 28(2) of the Act. 


Original signed by: May 24, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Housing 
(the Ministry). The complainant, an employee of the Ministry, was concerned that in March, 
1993, her then acting manager (the Manager) had disclosed her personal information to her 
Director and to the Ministry’s Co-ordinator, Workplace Discrimination and Harassment 
Prevention Program (the WDHP Co-ordinator), without her consent. The complainant believed 
that the disclosures had breached the Freedom of Information and Protection of Privacy Act (the 
Act). 


The complainant advised that the disclosures had arisen from her work situation. According to 
the complainant, her supervisor had confided to her that he was in love with a clerk in their 
department. He had continuously interrupted her work by talking about his feelings for the 
clerk. In the complainant’s view, her supervisor was sexually harassing the clerk, as the clerk 
had not returned the supervisor’s affections. 


The complainant had then discussed her work situation with the Manager. Since the complainant 
felt that the constant interruptions by her supervisor was negatively affecting her work 
performance, she had asked the Manager for a transfer out of the department. The complainant 
said that she had requested that their discussion be kept confidential, and that her Manager had 
agreed. However, her Manager later informed the Director and the WDHP Co-ordinator that 
the complainant had made allegations of sexual harassment concerning her supervisor and the 
clerk. During the course of her investigation, the WDHP Co-ordinator had contacted the 
complainant who had declined to answer any questions. The WDHP investigation was 
subsequently dropped. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) — Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the personal information disclosed in compliance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, 
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(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


It is our view that the complainant’s name together with the fact that she had complained about 
an alleged harassment of the clerk by her supervisor, was personal information as defined in 
section 2(1) of the Act. 


Conclusion: The information in question was "personal information", as defined in 
section 2(1) of the Act. 


Issue B: Was the personal information disclosed in compliance with section 42 of the 
Act? 


Under the Act, an institution cannot disclose personal information in its custody or under its 
control except in the circumstances outlined in section 42. 


Disclosure to the WDHP Co-ordinator 


The Ministry advised that according to the WDHP Directive and Guidelines, the Manager had 
been required to disclose the complainant’s name, and the details of the information concerning 
the harassment, to the WDHP Co-ordinator. The Ministry was of the opinion that a failure to 
take such action would have constituted a violation of the Ontario Human Rights Code, the 
Collective Agreement, and the Public Service Act. 


The Ministry further stated that under the WDHP Directive, managers are responsible for 
maintaining a work environment that is free from harassment and discrimination. Whether or 
not an employee wishes a matter to be investigated, when a possible instance of harassment or 
discrimination is brought to a manager’s attention, that manager is required to take action. As 
the alleged victim had not come forward, the WDHP Co-ordinator was advised of the 
complainant’s status as the only known witness. The Ministry also stated that the Manager did 
not recall the complainant requesting confidentiality. 


The Ministry identified the following statements from the WDHP Directive and Guidelines, as 
supporting the disclosure: 


Managers and Supervisors are responsible for initiating, in consultation with 
appropriate individuals, remedial procedures with respect to discrimination 
harassment or reprisal as quickly as possible upon becoming aware of it, whether 
or not a complaint has been filed; (emphasis added) 


A manager responding to an informal complaint should consult others, such as 


advisors, investigators, human resources staff, or the WDHP unit before handling 
an issue... 
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In our draft report, we stated that it was our view, however, that the above statements did not 
provide any basis for the disclosure of the complainant’s identity in this particular situation, nor 
was there any support for the disclosure of her identity elsewhere in the WDHP materials 
provided to us by the Ministry. The Ministry also had not referred us to any particular 
provisions in the Collective Agreement, the Ontario Human Rights Code, or the Public Service 
Act that specifically supported the disclosure. 


In our draft report, we acknowledged that the Ministry had obligations under the WDHP 
Directive and the Human Rights Code to deal with the complainant’s allegations and that there 
may be situations or times when the identity of a third party i.e. a witness, is required. For 
example, in this case, after the WDHP Co-ordinator had contacted the complainant’s supervisor 
and the clerk, the investigation was dropped, since the clerk apparently did not feel that any 
harassment had occurred. Had the investigation proceeded, it may well have been necessary 
for the Manager to have then disclosed the complainant’s name in order to assist in the 
investigation. 


However, it was our view that the Ministry had not demonstrated that in this case, it was 
necessary for the Manager to disclose the complainant’s identity when he initially informed the 
WDHP Co-ordinator of the situation concerning the complainant’s supervisor and the clerk. 


In our draft report, we stated that the Ministry had not indicated the section of the Act that it 
had relied on for the Manager’s disclosure to the WDHP Co-ordinator. In its representations 
on the draft report, the Ministry stated that it had relied on section 42(d) of the Act for the 
disclosure. This section states that: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) where disclosure is made to an officer or employee of the 
institution who needs the record in the performance of his or her 
duties and where disclosure is necessary and proper in the 
discharge of the institution’s functions; 


In its representations, the Ministry submitted that the WDHP Co-ordinator required the 
information in the performance of her duties as the individual responsible for implementing the 
WDHP directive. 


The Ministry also stated that "given the object of the WDHP Directives and Guidelines and the 
relevant legislation is to ensure a harassment-free workplace, inquiries will often extend beyond 
the party who is the subject of the alleged harassment. In this case, the investigator went on to 
question the complainant, who refused to participate in the investigation." It was the Ministry’s 
view that, "Therefore, whether or not the clerk and the supervisor had denied or admitted to the 
allegations, the complainant’s evidence would have been required, in order to ensure that all of 
the relevant evidence was brought to light." 


While we accept the Ministry’s position that an investigation can extend beyond the party who 
is the subject of the alleged harassment and that it may be necessary to obtain the evidence of 
other individuals, it remains our view that in the circumstances of this case, the Manager did 
not need to disclose the complainant’s name when he first discussed the situation with the 
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WDHP Co-ordinator. It remains our view that at this stage, the WDHP Co-ordinator did not 
require the identity of the complainant in order to perform her duties under the WDHP directive, 
and, therefore, the Manager’s disclosure of the complainant’s personal information to the WDHP 
Co-ordinator was not in compliance with section 42(d) of the Act. 


We have examined the remaining provisions of section 42 of the Act and it is our view that none 
applied in the circumstances of this case. 


Disclosure to the Director 


The complainant was also concerned about the Manager’s disclosure of her name together with 
the details of her complaint to her Director without her consent. 


In our draft report, we stated that we had asked the Ministry for its position on this disclosure 
but had received no submissions. However, based on what information we had, it was our view, 
that the Manager’s disclosure to the Director, in the circumstances of this case, was not in 
compliance with the Act. 


However, in its representations on our draft report, the Ministry stated that it had relied also on 
section 42(d) of the Act for this disclosure. The Ministry advised that the Director was 
responsible for making final decisions on long term assignments (or re-assignments) in 
consultation with the Manager. It was the Ministry’s view that in this case, in order for the 
Director to consider the complainant’s request for a transfer out of the department, it was 
necessary for him to know the reason for the request, i.e., that the constant interruptions by her 
supervisor was affecting her work. The complainant was subsequently re-assigned to a new 
client group, reporting to a new supervisor. 


We have considered the Ministry’s representations on this disclosure and agree that in order for 
the Director to consider and discuss the complainant’s request for a transfer, it was necessary 
for the Manager to disclose to him the details relating to the request. It is, therefore, our view 
that the Manager’s disclosure to the Director was to an employee who needed the complainant’s 
personal information in the performance of his duties and the disclosure was necessary and 
proper in the discharge of the Ministry’s administrative functions. The disclosure was, thus, in 
compliance with section 42(d) of the Act. 


Conclusions: The Manager’s disclosure of the complainant’s personal information to the 
WDHP Co-ordinator was not in compliance with section 42 of the Act. 


The Manager’s disclosure of the complainant’s personal information to the 
Director was in compliance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information”, as defined in section 2(1) of the 
Act. 
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e The Manager’s disclosure of the complainant’s personal information to the WDHP Co- 
ordinator was not in compliance with section 42 of the Act. 


e The Manager’s disclosure of the complainant’s personal information to the Director was 
in compliance with section 42 of the Act. 


RECOMMENDATION 


We recommend that the Ministry take steps to ensure that staff are reminded of the limited 
circumstances under the Act which permit the disclosure of personal information. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed by: June 8, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Metropolitan Toronto 
Housing Authority (the MTHA) of the Ministry of Housing (the Ministry). 


The complainant stated that she was a tenant in a MTHA building and that she was having a 
problem obtaining a parking sticker for her car. She had been told that she had to provide her 
driver’s licence, proof of vehicle ownership, and proof of car insurance to obtain a sticker. 


The Ministry acknowledged that the MTHA’s request for a driver’s licence and car insurance 
was not necessary, and that they would not be requested in future. However, it was still 
necessary to provide proof of vehicle ownership in order to obtain a sticker. The complainant 
believed that providing proof of residency and the car’s plate number should be sufficient. She 
was concerned that the MTHA’s practice of collecting proof of vehicle ownership was contrary 


to the provisions of the Freedom of Information and Protection of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information", as defined by section 
2(1) of the Act? If yes, 


(B) Was the MTHA’s collection of this personal information in compliance with 
section 38(2) of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined by section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an_ identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the disclosure of the 
name would reveal other personal information about the individual; 


The information in question was proof of vehicle ownership such as a motor vehicle registration 
and would include such details as the name of the individual and that he or she was the owner 
of a particular vehicle. 
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It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the MTHA’s collection of this personal information in compliance with 
section 38(2) of the Act? 


Under the Act, an institution cannot collect personal information except in compliance with 
section 38(2) of the Act which states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Ministry stated that the MTHA’s collection was in accordance with the MTHA Parking 
Management Program (the Program) which "works under the authority of the Municipal By- 
laws". In this particular case, the MTHA was relying on the Corporation of Scarborough By- 
Law Number 24165. This By-Law prohibited the parking or leaving of motor vehicles on private 
property without the consent of the owner or occupant of the property and on property owned 
or occupied by the Corporation of the City of Scarborough or any local board without the 
consent of the Corporation or local board. Under the By-law, an "occupant" is "the tenant of 
the real property...whose consent under the by-law extends only to the control of the land of 
which such occupant is a tenant and any parking spaces allotted to such occupant under a lease 
or tenancy agreement;” 


The Ministry advised us that the Program was created to provide residents and staff the best 
parking facilities possible. MTHA Security Staff had been trained and certified as Municipal 
Law Enforcement Officers (MLEOs). As MLEOs, they were authorized to enforce MTHA 
parking regulations by tagging and towing of vehicles, pursuant to By-Law 24165. 


We agree with the Ministry that administering the Program which included parking control was 
a lawfully authorized activity. However, the Ministry must also demonstrate that the collection 
of the personal information in question was necessary to the proper administration of this 
lawfully authorized activity. 


The Ministry informed us that MTHA residents did not pay for parking. The Ministry submitted 
that the MTHA lease clearly stated that a tenant had "no right to use the parking facilities”. 
MTHA parking space was limited. Certain rules and regulations had been set up "to provide 
residents with parking space on a first come, first served basis”. 
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The Ministry submitted that in order to qualify for a parking sticker, both proof of residency and 
personal ownership of a vehicle was required. The "structure" of the program requiring tenants 
to show a personal need for a parking space for their vehicle had been chosen "at the request 
of the community in order to prevent non-residents from parking their vehicle on MTHA 
property". The Ministry further stated that this "decision resulted in the establishment of a 
sticker system where stickers would only be given to those tenants who own a vehicle, and only 
for those vehicles”. 


The Ministry stated that, therefore, given the requirement under the Program for both residency 
and personal ownership, the only document that could be requested to provide proof of this was 
the motor vehicle registration and that the collection of this information was "fundamental to the 
proper administration of the program". 


It is our view that since the Program required proof of both residency and personal ownership 
of a vehicle, it was necessary for the MTHA to collect motor vehicle registration information. 
Therefore, the MTHA’s collection was necessary to the proper administration of a lawfully 
authorized activity, i.e., the management of the Program, in compliance with section 38(2) of 
the Act. 


Conclusion: The MTHA’s collection of proof of vehicle ownership was in compliance 
with section 38(2) of the Act. 


Other Matters 


During the course of this investigation, we noted that proper notice for the collection of personal 
information for parking stickers had not been given to tenants as required by section 39(2) of 
the Act. This section states: 


Where personal information is collected on behalf of an institution, the head shall, 
unless notice is waived by the responsible minister, inform the individual to 
whom the information relates of, 


(a) the legal authority for the collection; 


(b) the principal purpose or purposes for which the personal 
information is intended to be used; and 


(c) the title, business address and business telephone number of a 
public official who can answer the individual’s questions about the 
collection. 


We were advised by the Ministry that the MTHA had been informed that its form for collecting 
personal information must comply with the notice provisions of section 39(2) of the Act. We 
understand, however, that the form has not yet been amended. 


Conclusion: The MTHA’s form for collecting personal information was not in 
compliance with section 39(2) of the Act 


[IPC Investigation/March 20, 1995] 


SUMMARY OF CONCLUSIONS 


0 The information in question was personal information as defined in section 2(1) of the 
Act. 

0 The MTHA’s collection of proof of ownership was in compliance with section 38(2) of 
the Act. 

0 The MTHA’s form for collecting personal information was not in compliance with 


section 39(2) of the Act. 


RECOMMENDATIONS 


We recommend to the Ministry that the MTHA provide notice for its collection of personal 
information on its form as required by section 39(2) of the Act. 


Within six months of receiving this report, the Ministry should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. 


Ann Cavoukian, Ph.D. Date 
Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Community 
and Social Services (the Ministry). 


The complainant was a permanent employee of a Ministry youth detention centre. He also held 
a part-time position with a named children’s aid society (the CAS). A ward of the CAS, who 
was temporarily in the custody of the Ministry, had told the complainant (as a Ministry 
employee) that he was afraid of being assaulted by another youth in a court holding cell. The 
CAS ward was subsequently assaulted by the youth. The complainant was mentioned in the 
incident report and was suspended for three days with pay while an investigation was conducted 
by the detention centre. The Ministry also advised the CAS of the incident pursuant to the 
provisions of the Child and Family Services Act (the CFSA). 


The complainant believed that the superintendent at the youth detention centre contacted the CAS 
and informed them that he had refused to meet with supervisors on two occasions and that the 
CAS should look into his work performance. It was the complainant’s view that the disclosure 
of this information was contrary to the provisions of the Freedom of Information and Protection 


of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Did the Ministry disclose the complainant’s personal information to the CAS in 
accordance with the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 
"personal information" means recorded information about an identifiable 


individual, including, 
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(g) the views or opinions of another individual about the individual. ... 


(h) the individual’s name if it appears with other personal information relating 
to the individual... 


The information in question was the complainant’s name together with the information that he 
had missed two scheduled meetings and the opinion that his work performance should be 
monitored. 


It is our view that this information satisfied the requirements of paragraphs (g) and (h) of the 
definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Did the Ministry disclose the complainant’s personal information to the CAS 
in accordance with section 42 of the Act? 


The Ministry informed us that when there is an allegation of child abuse which involves the 
Ministry, the Ministry is responsible for reporting the incident to the CAS as well as 
investigating the matter itself. In this case, where an employee, the complainant, had been cited 
in the incident report, the procedure was that the Ministry was to interview the complainant and 
then advise the CAS when the interview had been completed, so that the CAS could proceed 
with its own interview. Both the Ministry and the CAS agreed that this was the practice. 


The Ministry stated that the disclosure of information to the CAS had been limited to the 
complainant’s actions with respect to the reported incident. The Ministry acknowledged that the 
superintendent had told the CAS that the complainant had missed two scheduled meetings with 
her to discuss the incident. The Ministry denied that the superintendent had told the CAS that 
the complainant’s work performance should be monitored. 


The superintendent advised us that she had spoken only with the CAS staff member who was 
doing the investigation (the Investigator) and that she had not said that the complainant’s work 
should be monitored. 


The complainant provided us with the names of five CAS staff members, who according to the 
complainant, could attest to the superintendent’s alleged comments about his performance. 
Three of the CAS staff members informed us that they had "heard" that the complainant’s work 
performance should be monitored but that they had not spoken directly-with the superintendent 
on this matter. 


The CAS director informed us that the CAS could not disclose information provided to the CAS 


by another party in the course of an investigation. However, the director stated that the CAS’s 
contact with the superintendent was to follow up on the incident to determine whether the harm 
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received by the ward could have been reasonably prevented and to discuss strategies for 
addressing concerns regarding youths in holding cells. 


Based on the information we received from the Ministry, the CAS and the complainant, we are 
able to determine only that the superintendent told the CAS that the complainant had missed two 
scheduled meetings but not whether she also said that the CAS should monitor the complainant’s 
work performance. 


Under the Act, an institution cannot disclose personal information in its custody or control 
except in the specific circumstances outlined in section 42 of the Act. 


The Ministry stated that it had relied on section 42(e) of the Act to disclose the complainant’s 
personal information relating to the scheduled meetings to the CAS. Section 42(e) states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(e) for the purpose of complying with an Act of the Legislature or an 
Act of Parliament or a treaty, agreement or arrangement 
thereunder; 


The Ministry referred us to the CFESA. Section 72 of the CFESA states in part: 


A person who believes on reasonable grounds that a child is or may be in need 
of protection shall forthwith report the belief and the information upon which it 
is based to a society. 


Section 1.(2) of Regulation 71 under the CFSA states: 


The society shall investigate each complaint within twenty-one days after the 
complaint is recorded ... 


In our view the legislation cited by the Ministry did not require the disclosure of the 
complainant’s specific information, i.e., that he had missed two scheduled meetings with the 
superintendent. Since the CFSA did not impose a duty on the Ministry to disclose this 
information, section 42(e) of the Act was not applicable. 


It is our view, however, that section 42(c) of the Act was the relevant provision in the 
circumstances of this case. This section states: 
An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


[IPC Investigation 194-095P/May 30, 1995] 


Section 43 further provides that: 


43. | Where personal information has been collected directly from the 
individual to whom the information relates, the purpose of a use 
or disclosure of that information is a consistent purpose under 
clauses 41(b) and 42(c) only if the individual might reasonably 
have expected such a use or disclosure. 


As previously indicated, it was a part of the agreed practice between the Ministry and the CAS 
that the Ministry would first interview the complainant. It was normal procedure for the 
superintendent to advise the CAS when a meeting with the complainant would be held. After 
the Ministry’s meeting was completed, the CAS was to continue its own investigation which 
included meeting with the complainant. The superintendent stated that she had informed the 
CAS Investigator of two dates she was to have met with the complainant. However, she stated 
that when the complainant-did not attend these scheduled meetings, she had informed the CAS 
of this since any delays in the Ministry interviewing the complainant could also affect the CAS, 
particularly as the CAS was required to complete its own investigation within twenty one days. 


In our draft report, we indicated that it was our view that the Ministry would have compiled the 
complainant’s personal information that he had not attended the two scheduled meetings as a part 
of its investigation into the incident of alleged abuse. The Ministry disclosed this personal 
information to the CAS so that the CAS would be informed since this could cause a possible 
delay in the CAS’s investigation. The incident had been reported to the CAS; the complainant 
had been named in the report and the CAS was required to interview him. It was our view that, 
therefore, the complainant could reasonably have expected that if he did not attend the two 
scheduled meeting relating to the incident, the Ministry would inform the CAS of this. It was 
our view that the Ministry’s disclosure was for a consistent purpose, in compliance with section 
42(c). 


Prior to the preparation of our draft report, the complainant had informed us that it was his view 
that the meetings had been unreasonably scheduled by the superintendent. However, in his 
comments on the draft report, the complainant subsequently stated that he had never been 
advised of any such meetings and that there had been no scheduled meetings that he had not 
attended. 


We asked the Ministry for its views on the complainant’s statements. The Ministry’s position 
was that the superintendent had scheduled meetings with the complainant which he did not 
attend; that she had left messages on the complainant’s answer machine and his pager about the 
meetings. However, the superintendent was unable to specify the exact dates of the two 
scheduled meetings, although she believed that they had been scheduled for September 27 and 
30, 1994, respectively. We were also unable to obtain any supporting information from the 
CAS about these meetings. 


We remain of the view that if there had been scheduled meetings and the complainant was 
advised of them, then he could reasonably have expected the Ministry’s disclosure to the CAS 
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that he had not attended these meetings. The Ministry’s disclosure would have been in 
compliance with section 42(c) of the Act. However, given the conflicting information provided 
to us by the complainant and the Ministry, we are unable to determine if such meetings were 
scheduled and if the complainant was aware of them. We are, thus, unable to conclude whether 
or not the Ministry’s disclosure to the CAS was in compliance with section 42(c) of the Act. 


Conclusion: We are unable to determine if the Ministry’s disclosure of the 


complainant’s personal information to the CAS was in compliance 
with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


i) The information in question was “personal information" as defined in section 2(1) of the 
Act. 
0 We are unable to determine if the Ministry’s disclosure of the complainant’s personal 


information to the CAS was in compliance with section 42 of the Act. 


Onginal signed by: May 30, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint about the Ministry of Finance (the 
Ministry). The complainant, an employee of the Ministry, was concerned that the Ministry’s 
collection of employees’ Social Insurance Number (SIN) on three internal forms, entitled 
"Statement of Travelling Expenses", "Request for Leave of Absence", and "Request for 
Advance", was in contravention of the Freedom of Information and Protection of Privacy Act 
(the Act.) The complainant stated that if the SIN was not provided, the forms were returned to 
the employee, unprocessed. 


The complainant was also concerned about the lack of confidentiality during the processing of 
these forms. The complainant stated that the forms passed through several hands, and were 
often left unattended on staff desks, where unauthorized individuals could have access to the 
SIN. The complainant stated that it was possible for someone to obtain personal, financial and 
medical information from Revenue Canada, or from the insurance company providing employee 
benefits by providing a name, address and the SIN. 


Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the personal information collected in compliance with section 38(2) of the 


Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act defines “personal information" as recorded information about an 
identifiable individual, including, 
(c) any identifying number, symbol or other particular assigned to the 
individual, 
Each of the three forms required the SIN to be provided. It is our view that the SIN is a unique 


identifying number assigned to an individual, and, therefore, meets the requirements of 
paragraph (c) of the definition of "personal information" in section 2(1) of the Act. 
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Conclusion: The information was personal information, as defined in section 2(1) of the 
Act. 


Issue B: Was the personal information collected in compliance with section 38(2) of the 
Act? 


Section 38(2) of the Act sets out the conditions for which personal information can be collected 
on behalf of an institution. This section states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for the purposes of law enforcement 
or necessary to the proper administration of a lawfully authorized activity. 
[Emphasis added] 


In our view, the Ministry’s collection of the SIN on the three forms was not expressly authorized 
by statute nor was the collection for the purposes of law enforcement. We, therefore, examined 
whether the Ministry’s collection met the third condition, i.e., necessary to the proper 
administration of a lawfully authorized activity. 


The Ministry advised that the SIN was required on all three forms "to facilitate the 
administrative and accounting process." The Ministry also stated that the SIN was used "as a 
cross reference to the payroll system when T4’s and T4A’s are issued for tuition reimbursement 
and payment of professional contract staff." We noted, however, that none of the forms were 
specifically related to tuition reimbursement or to payment for contract staff. 


In our view, the facilitation of an administrative and accounting process was a lawfully 
authorized activity. We, therefore, considered if the Ministry’s collection of the SIN was 
necessary to the proper administration of this lawfully authorized activity. 


"CORPAY" is the payroll system for all government employees. The SIN is used as an 
employee identifier to access CORPAY. 


The "Request for Leave of Absence” form has to be completed when an employee applies for 
leave for various reasons, with or without pay, including maternity leave, bereavement leave, 
and jury duty. 


In order for an employee to receive their correct salary and benefits, the information on this 
form is cross-referenced to CORPAY, which is accessed via the employee’s SIN. It is, 
therefore, our view that the Ministry’s collection of SIN on this form was necessary for the 
proper administration of a lawfully authorized activity, i.e., to facilitate the Ministry’s payroll 
administration process. The Ministry’s collection of the SIN on this form was, thus, in 
compliance with section 38(2) of the Act. 


The purpose of the "Request for Advance” form and the "Statement of Travelling Expenses" 
form is to reimburse employees for out-of-pocket expenses incurred while travelling on Ministry 
business. 


In our view, however, the Ministry’s collection of the SIN on these forms was not necessary to 
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facilitate the administrative and accounting process involved, as employees could be reimbursed 
without accessing CORPAY. Cross-referencing for income tax purpose was not required for 
these two forms. For comparison purposes, we reviewed our office’s "Statement of Travelling 
Expenses” and "Request for Advance” forms. The SIN is not required on either of these two 
forms. 


The Ministry stated that it was the Ministry’s intention in future to facilitate direct deposits of 
reimbursements through the payroll system which would require the SIN. However, this was 
not the Ministry’s present process for reimbursements and was not the purpose for which the 
SIN was collected on these two forms. 


In our view, the Ministry’s collection of employees’ SIN on the “Statement of Travelling 
Expenses” and the "Request for Advance” forms was not necessary to the proper administration 
of a lawfully authorized activity and was, thus, not in compliance with section 38(2) of the Act. 


Conclusion: The Ministry’s collection of employees’ SIN on the "Request for Leave 
of Absence" form was in compliance with section 38(2) of the Act. 


The Ministry’s collection of employees’ SIN on the "Statement of Travelling Expenses" 
and the "Request for Advance” forms was not in compliance with section 38(2) of the 
Act. 


Other Matters 


The complainant was concerned about the confidentiality of employees’ SIN since the 
complainant believed that the forms were often left unattended on staff desks. The complainant 
explained that it was the number of staff having unnecessary access to an employee’s SIN, rather 
than the actual administrative process, that was the cause for concern. The complainant advised 
that the procedure for filing the forms was as follows: 


The completed form was given to a manager for approval, then mailed by the manager’s 
secretary to a second location in the program area, and a copy put on file. The secretary at the 
second location opened the mail, delivered it to the administrative clerk, who then entered the 
information on the on-line financial information system, and forwarded the form to Finance and 
Administration. Here, one or two staff members processed the employee’s cheque. 


In our view, the complainant’s concerns would be reduced if the SIN was omitted from the two 
forms that do not require the SIN, i.e., the "Statement of Travelling Expenses" form and the 
"Request for Advance" form. 


However, we would like to remind the Ministry of the requirements of sections 4(1) and 4(2) 
of Regulation 460 under the Act, which state respectively that “Every head shall ensure that 
reasonable measures to prevent unauthorized access to records in his or her institution are 
defined, documented and put in place..." and "Every head shall ensure that only those who need 
a record for the performance of their duties shall have access to it." 
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SUMMARY OF CONCLUSIONS 


e¢ The information in question was personal information, as defined in section 2(1) of the Act. 


e The Ministry’s collection of employees’ SIN on the "Request for Leave of Absence” form 
was in compliance with section 38(2) of the Act. 


e The Ministry’s collection of employees’ SIN on the "Statement of Travelling Expenses” and 
the "Request for Advance” forms was not in compliance with section 38(2) of the Act. 


RECOMMENDATION 


In our draft report, we recommended that the Ministry cease the collection of employees’ SIN 
on its "Statement of Travelling Expenses” and "Request for Advance” forms. 


In its response, the Ministry informed us that it was currently analyzing the systems changes 
necessary to accommodate the elimination of the employee’s SIN as a reference on its 
"Statement of Travelling Expenses" and "Request for Advance” forms and its travel expenditure 
records. The Ministry stated, however, that a six month period for compliance with our 
recommendation was "administratively awkward in relation to the use of two different employee 
references during an annual cycle for recording travel expenditure data.” 


We, therefore, ask that within six months of receiving this report, the Ministry provide us with 
either proof of compliance with our recommendation or an update on its implementation. 


Onginal Signed by: May 2, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Housing 
(the Ministry). 


The complainant, an employee of the Ministry, was advised in a meeting with the director of 
the branch (the Director) and the manager of the section where she was employed, that she was 
being suspended for 20 days pending an investigation. According to the complainant, once she 
had left the office, the Director called a branch meeting, with the manager, and disclosed to the 
branch staff that she had been suspended. 


The complainant was concerned that this disclosure of her personal information was not in 
compliance with the Freedom of Information and Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the complainant’s personal information to her co-workers 
in compliance with section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an _ identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the 
disclosure of the name would reveal other personal 
information about the individual; 
The information in question was the complainant’s name together with the fact that the 
complainant had been suspended from employment. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
personal information in section 2(1) of the Act. 
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Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the disclosure of the complainant’s personal information to her co- 
workers in compliance with section 42 of the Act? 


Under the Act, personal information cannot be disclosed except in the specific circumstances 
outlined in section 42 of the Act. 


The complainant maintained that it was not necessary for the Director to disclose to branch staff 
that she had been suspended. The complainant stated that, as an alternative, the Director could 
have communicated that she would be away from the office for 20 days. The complainant stated 
that the issues surrounding the suspension were private issues which did not involve the branch 
staff. The complainant was of the view that the word "suspension" implied a disciplinary leave 
and, thus, should not have been communicated. 


The Ministry clarified that the disclosure of the complainant’s personal information was not to 
all staff in the branch but to those staff in the section where the complainant was employed (her 
co-workers). 


The Ministry has relied upon section 42(d) of the Act as its authority to disclose the personal 
information. Section 42(d) states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) where disclosure is made to an officer or employee of the 
institution who needs the record in the performance of his 
or her duties and where disclosure is necessary and proper 
in the discharge of the institution’s functions; 


The Ministry advised us that one of its functions is to protect the security of its information and 
property. The Ministry stated that it is its normal business practice (and that of other 
ministries), when someone leaves for reasons such as contract termination or suspension, for 
appropriate precautions to be taken in limiting potential access. In this case, the complainant’s 
access to the computer service (LAN) was removed, as was her access to the building and to the 
general office. 


The Ministry submitted that it was its view that, in cases where suspensions pending 
investigations are required, where there may be a reasonable basis for security concerns, these 
concerns should in some way be communicated to the employee’s co-workers, in order for them 
to perform their duties and properly discharge the functions of the Ministry. 


The Ministry stated that it is management’s right to remove an employee from the workplace 


for a period of time in accordance with the Public Service Act, when it has been determined that 
an investigation should be conducted. 
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The Ministry advised that, as investigations can include the review of files and other records, 
it is common practice to require that the employee not return to the workplace so that the 
integrity of those records is preserved for the purposes of the investigation. It stated that in this 
case, the nature of the work performed by the complainant entitled her access to a wealth of 
personal, confidential personnel information and that it would have been inappropriate for her 
to continue to have had access to this information while under active investigation. The Ministry 
stated that the complainant also had numerous clients within the Ministry, therefore, her co- 
workers needed to know that she would not be at work for a particular duration of time because 
of a suspension. 


The Ministry maintained that the complainant’s co-workers would not have been in a position 
to take adequate precautions in respect of their own security and in particular, the security of 
Ministry information, if they had been told, without further explanation, that an employee would 
not be returning to work for 20 days. If they did not disclose that the complainant had been 
suspended, it would have been necessary to tell the complainant’s co-workers that she was not 
entitled to have access, during a 20 day period, to the section’s premises, information or 
computer services (LAN), and that the Manager should be notified if the complainant had 
requested such access. The Ministry stated that these facts could have led co-workers to 
conclude that the complainant had been suspended. 


The Ministry maintained that, having examined the alternatives, the announcement of the 
complainant’s suspension to her immediate co-workers was an effective means of conveying to 
them the information they required in order to enable them to perform their duties and to 
discharge the Ministry’s functions (i.e., to protect the security of Ministry information and 
property). The Ministry stated that, since this was the case, the disclosure of the complainant’s 
suspension to her co-workers, was authorized under section 42(d) of the Act. 


In discussions with the complainant, she stated that it was her view that the Ministry did not 
have a reasonable basis for security concerns. She stated that the reasons for her suspension 
would not have been sufficient to cause the Ministry to be concerned about the security of its 
information and property. 


The complainant further stated in her comments on our draft report, that there had never been 
any security concerns about her nor was "security" the reason for her suspension. She also 
stated that it was her view that telling her co-workers that she had been suspended did not imply 
that she should be denied access to the premises, and that the Director "could have taken 
appropriate action and disclosed that [the complainant] should not be on the premises without 
using the word "suspension" which has a disciplinary conotation [sic] and is a private matter." 
The complainant further stated that the "Ministry had every right to tell the co-workers that [she] 
would not be around for 20 days, but they did not have the right to say that [she] was 
"suspended"". 
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However, it is our view that it is not within our jurisdiction to determine whether the Ministry’s 
reasons for suspending the complainant were valid, or whether those reasons were sufficient to 
cause the Ministry to have concerns about the security of its information and property. The 
Ministry, under the Public Service Act, had the authority to suspend the complainant pending 
an investigation. The complainant was "suspended" and this was the term used by the Ministry 
to state the reason for her absence. 


It is our view that one of the Ministry’s functions was to ensure that information and property 
maintained within its custody and control was properly secured. The Ministry stated that in 
order to maintain the security of its information and property, it was necessary to advise the 
complainant’s co-workers that she had been suspended. The Ministry further stated that this was 
a way of conveying to them that the complainant was not to have access to the section’s 
premises, information or computer service (LAN), and that the manager should be notified if 
the complainant requested such access. 


We agree with the Ministry that if it had concerns for the security of its property and 
information, it would have been necessary to communicate those concerns to the co-workers and 
that it would not have been sufficient to simply tell them that the complainant would not be 
returning to work for 20 days. They would not have been aware that precautions should be 
taken in limiting the complainant’s access to the information and property in the section. In our 
view, disclosing to her co-workers that the complainant had been suspended had the same result 
as communicating to them that she was not to have access to the section’s premises, information 
or computer service (LAN). 


In our view, the Ministry has demonstrated that its disclosure that the complainant had been 
suspended was to employees who needed to know this in the performance of their duties, and 
the disclosure was necessary and proper in the discharge of the Ministry’s function of ensuring 
the security of its information and property. Therefore, the Ministry’s disclosure of the 
complainant’s suspension to her co-workers was in compliance with section 42(d) of the Act. 


Conclusion: The disclosure of the complainant’s personal information to her co- 
workers was in compliance with section 42 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 
e The disclosure of the complainant’s personal information to her co-workers was in 


compliance with section 42 of the Act. 


Original signed by: April 4, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Y Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a police services board (the 
Police). 


The complainant stated that he and two other individuals had been the subject of an investigation 
conducted by the Police on January 17, 1994. This investigation had been initiated at the 
request of their former employer (the employer). As a result of the investigation, an occurrence 
report had been prepared by the Police. No charges, however, were laid against the complainant 
or the other individuals. The complainant later made an access request to the Police, under the 
Municipal Freedom of Information and Protection of Privacy Act, (the Act), for a copy of the 
occurrence report. He received a copy with the personal information of the other individuals 
severed from it. 


On the same day that the Police had conducted its investigation, the complainant had been 
dismissed from his employment. The complainant subsequently filed a wrongful dismissal 
complaint with the Ontario Labour Relations Board (the OLRB). A mediation hearing between 
the complainant, the employer and an OLRB representative was held to determine whether the 
dispute could be settled without going to a possibly lengthy hearing. 


As part of the process, the lawyers for the parties to the dispute exchanged documents. Among 

the documents given by the employer’s lawyer to the complainant’s lawyer was an unsevered 
)y copy of the occurrence report. 

The complainant stated that he did not authorize the Police to release the occurrence report to 

his former employer and was concerned that the disclosure of his personal information was 

contrary to the provisions of the Act. . 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the complainant’s personal information in compliance with 
section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


») Issue A: Was the information in question "personal information" as defined in section 
7 2(1) of the Act? 
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Section 2(1) of the Act defines "personal information", in part, as: 


recorded information about an identifiable individual, including 


(d) the address, telephone number, finger prints or blood type of the 
individual, 


(h) — the individual’s name where it appears with other personal information 
relating to the individual or where the disclosure of the name would reveal 
other personal information about the individual; 


The information in the occurrence report included the complainant’s name together with his date 
of birth, address, telephone number and other information about him . It is our view that this 
information met the requirements of paragraphs (d) and (h) of the definition of “personal 
information” in section 2(1) of the Act. 


Conclusion: The information was the complainant’s personal information, as defined 
in section 2(1) of the Act. 


Issue B: Was the disclosure of the complainant’s personal information in compliance 
with section 32 of the Act? 


The Police stated that the investigating officers would have prepared the occurrence report using 
the WordPerfect computer system. A printout of that document would have then been given to 
an operator who would have entered the information into the Ontario Municipal and Provincial 
Police Automation Cooperative (OMPPAC) system which is managed by the Ministry of the 
Solicitor General and Correctional Services, and is shared by a number of police services across 
Ontario and the Ontario Provincial Police. It is an on-line system that can be used by any 
police service that is authorized to access OMPPAC. 


The Police, however, acknowledged that the occurrence report released to the complainant as 
a result of his access request was not a record that was generated from OMPPAC; it was a 
printout of the WordPerfect document created by the investigating officers. We compared this 
copy of the occurrence report with the one that had been provided by the employer’s lawyer to 
the complainant’s lawyer. The two documents appeared to have been copied from the same 
source, i.e. the WordPerfect printout. The two documents were identical except that the copy 
which the complainant had obtained through his access request had the personal information of 
the other individuals severed. 


The Police informed us that the investigation officers did not recall releasing a copy of the 
occurrence report to the employer and that the only means by which the employer might have 
received a copy of the occurrence report was by filing an access request under the Act. 
The Freedom of Information and Privacy Co-ordinator for the Police, however, stated: 


. at no time did I, acting in my capacity as Freedom of Information & 
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Protection of Privacy Coordinator, release a copy of our occurrence report 
#1490015 to the [named employer] or its representatives. Further, I have never 
received a request from the [named employer] or its representatives. As well a 
copy of this report was not released from the Records Department of the [named] 
Police to the [named employer] or its representatives at any time. 


The Police also stated that they contacted the employer and was advised that the personal 
information released to the complainant’s lawyer was information that was compiled from the 
complainant’s employment records. We contacted the employer who stated that since the 
privacy legislation did not apply to them, they preferred not to comment as to how they might 
have obtained a copy of the occurrence report. 


Although we are unable to determine conclusively how the employer obtained a copy of the 
occurrence report, based on the information available to us, it is our view that in all likelihood 
it was the Police who provided a copy to them, thereby disclosing the complainant’s personal 
information. 


Under the Act, an institution cannot disclose personal information in its custody or under its 
control except in the specific circumstances outlined in section 32. (The full text of section 32 
is given in Appendix A.) 

We have examined the provisions of section 32 and it is our view that none applied in the 
circumstances of this case. Therefore, the Police’s disclosure of the complainant’s personal 
information to the employer was not in compliance with section 32 of the Act. 


Conclusion: The Police’s disclosure was not in compliance with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information was the complainant’s personal information, as defined in section 2(1) 
of the Act. 

e The Police’s disclosure was not in compliance with the section 32 of the Act. 

RECOMMENDATIONS 


We recommend that the Police take steps to ensure that in future, all disclosures of personal 
information are made in compliance with the Act. 


Within six months of receiving this report, the Police should provide the Office of the 


Information and Privacy Commissioner/Ontario with proof of compliance with the above 
recommendation. 
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An institution shall not disclose personal information in its custody or under its control 


except, 
(a) 
(b) 


(c) 


(d) 


(e) 


(f) 


(g) 


(h) 


(i) 


G) 
(k) 
(1) 


APPENDIX A 


in accordance with Part I; 


if the person to whom the information relates has identified that 
information in particular and consented to its disclosure; 


for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


if the disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and if the 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


for the purpose of complying with an Act of the Legislature or an Act of 
Parliament, an agreement or arrangement under such an Act or treaty; 


if disclosure is by a law enforcement institution, 


(i) toa law enforcement agency in a foreign country under an 
arrangement, a written agreement or treaty or legislative 
authority, or 

(ii) | to another law enforcement agency in Canada; 


if disclosure is to an institution or a law enforcement agency in Canada to 
aid an investigation undertaken with a view to a law enforcement 
proceeding or from which a law enforcement proceeding is likely to 
result; 

in compelling circumstances affecting the health or safety of an individual 
if upon disclosure notification is mailed to the last known address of the 
individual to whom the information relates; 


in compassionate circumstances, to facilitate contact with the next of kin 
or a friend of an individual who is injured, ill or deceased; 


to the Minister 
to the Information and Privacy Commissioner; 


to the Government of Canada of the Government of Ontario in order to 
facilitate the auditing of shared cost programs. 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a municipal town (the 
Town). 


The complainant was suspended from his position as the Town’s chief of police. During his 
suspension, the complainant applied for employment with a city (the City). When making this 
application to the City, the complainant did not provide anyone from the Town as a reference, 
and the Town was not aware that he had made such an application. However, according to the 
complainant, the City contacted the Town and the Town disclosed his salary and the fact that 
he had been suspended as chief of police. 


The complainant was concerned that the Town’s disclosure of his salary and suspension to the 
City, without his consent, was contrary to the Municipal Freedom of Information and Protection 
of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If yes, 


(B) Was the specific personal information disclosed by the Town? 


(C) Did section 27 of the Act apply to the complainant’s personal information that he 
had been suspended? 


(D) Was the complainant’s personal information that he had been suspended disclosed 
in compliance with section 32 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states that personal information "means recorded information about an 
identifiable individual". 


The information in question was the complainant’s salary and the fact that he had been 
suspended as chief of police by the Town. While the complainant’s name was not specifically 
mentioned in the telephone conversation between the Town and the City, he was referred to as 
the "chief of police" and was, therefore, an identifiable individual. 
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It is our view that the information in question met the requirements of the definition of personal 
information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the specific personal information disclosed by the Town? 


The complainant stated that his actual salary and the fact that he was suspended had been 
disclosed by the Town. 


Both the City and the Town agreed that the Town had disclosed the fact that the complainant had 
been suspended. The Town had advised the City that "no negotiation had been undertaken 
recently due to the current-Chief’s suspension". 


However, with respect to the complainant’s salary information, the Town stated that, when the 
City requested information regarding the salary "Classes" for the chief of police, the Town 
advised the City that it did not understand the request for "Classes", and that "the Chief’s salary 
was in a specified range and that there were four classes of constables included in the range of 
salaries quoted...from mid-forty to mid fifty-five thousand range.” 


The Town maintained that it did not tell the City "specific dollar amounts", nor did it refer to 
the complainant or to his salary directly; "at no time was [the complainant’s] name or salary 
mentioned during the conversation in question.” 


The City advised us that the Town stated that the Town did not have ranges of salaries. The 
City said that it was not given a salary range nor was it given the complainant’s actual salary. 


Both the City and the Town agreed that the complainant’s actual salary had not been disclosed. 
However, based upon the conflicting information provided to us by the Town and the City, we 
are unable to determine whether the complainant’s salary range was disclosed by the Town. 


Conclusion: The complainant’s suspension was disclosed by the Town. The 
complainant’s actual salary was not disclosed by the Town. 


Issue C: Did section 27 of the Act apply to the complainant’s personal information 
that he had been suspended? 


The Town stated that the fact that the complainant was suspended as chief of police was public 
knowledge. It stated that a resolution regarding the suspension was passed at an open meeting 
of the Police Services Board for the Town and that the local newspapers had published articles 
related to the suspension. 
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Therefore, we have examined whether section 27 of the Act was applicable to the personal 
information disclosed in this case. Section 27 of the Act states that: 


This Part does not apply to personal information that is maintained for the 
purpose of creating a record that is available to the general public. 


The Town provided a copy of minutes from a meeting of the Town’s Police Services Board. 
These minutes included the resolution that the complainant’s suspension be continued indefinitely 
at the discretion of the Police Services Board. The Town stated that the resolution was made 
at an open public meeting. 


Section 27 states that the privacy provisions of the Act do not apply to personal information that 
is maintained for the purpose of creating a record that is available to the general public. 
While the general public may have been aware that the complainant had been suspended as chief 
of police, and, while that information appeared in the Police Services Board’s minutes and was 
raised at a public meeting, the fact that the complainant had been suspended was not information 
that the Town was specifically maintaining "for the purpose of creating a record available to the 
general public". Accordingly, we do not consider this information to have been "public" within 
the meaning of section 27 of the Act. In our view, section 27 of the Act did not apply in the 
circumstances of this case. 


Conclusion: Section 27 of the Act was not applicable. 


Issue D: Was the complainant’s personal information that he had been suspended 
disclosed in compliance with section 32 of the Act? 


Under the Act, personal information cannot be disclosed except in the specific circumstances 
outlined in section 32. 


The Town submitted that, "regarding the Chief’s suspension, as resolutions were passed at open 
public meetings of the Police Services Board, we are relying on Section 63 regarding oral 
requests and access to public information." Since the Town is a "municipal institution", the 
comparable section to section 63 under the municipal Act is section 50. Section 50 of the Act 
provides that: 


(1) If a head may give access to information under this Act, nothing in this Act . 
prevents the head from giving access to that information in response to an oral 
request or in the absence of a request. 


(2) This Act shall not be applied to preclude access to information that is not 
personal information and to which access by the public was available by statute, 
custom or practice immediately before the 1st day of January, 1991.(emphasis 
added) 
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It is our view that section 50(1) must be read in conjunction with Part I of the Act and section 
32 of the Act in order to determine if "a head may give access to information under this Act". 
Thus, where a head may give access to information under Part I of the Act, section 32(a) would 
apply. Section 32(a) states that: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(a) in accordance with Part I; 


In past compliance investigations, we have held the view that the section 32(a) exception to the 
section 32 prohibition against the disclosure of personal information only applies in the context 
of a request by an individual, made under Part I of the Act, for personal information relating 
to another individual. Given that section 50(1) does not refer to "personal information", and 
bearing in mind that one of the purposes of the Act as set out in section 1(b) is to protect the 
privacy of individuals with respect to personal information, it is our view that section 50(1) 
should be interpreted narrowly. Therefore, in this case, since the disclosure did not involve an 
access request under Part I of the Act, it is our view that section 32(a) of the Act does not apply 
and that section 50(1) of the Act does not assist in determining whether the disclosure was in 
compliance with the Act. 


With respect to section 50(2) of the Act, this section specifically refers to information that is not 
"personal information". Since we have already determined that the information in question is 
"personal information", it is our view that this section does not apply. 


We have reviewed the remaining provisions of section 32 of the Act and it is our view that none 
were applicable in the circumstances of this case. 


Conclusion: The disclosure of the personal information was not in compliance with 
section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) 
of the Act. 
a The complainant’s suspension was disclosed by the Town. The complainant’s actual 


salary was not disclosed by the Town. 


e Section 27 of the Act was not applicable. 
* The disclosure of the personal information was not in compliance with section 32 of the 
Act. 
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RECOMMENDATIONS 
We recommend to the Town that: 


(1) it ensure that staff are reminded of the limited circumstances under which personal 
information may be disclosed in compliance with section 32 of the Act, for example, by sending 
a memorandum to all staff outlining, a) the type of information that would be considered 
"personal information" as defined in section 2(1) of the Act; and b) the disclosure provisions of 
section 32 of the Act. 


(2) it develop a policy addressing the circumstances for the external release of employees’ 
“personal information". For example, such a policy might state that "personal information" 
should not be released unless the employee first consents to the release of the particular 
information, or the release of the information is consistent with the purpose for which it was 
collected, or the release was required by law. 


Within six months of receiving this report, the Town should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendations. . 


Susan Anthistle Date 
Compliance Review Officer 
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INTRODUCTION 
Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Workers’ Compensation 
Board (the Board). The complainant stated that a named Board’s physician had improperly 
disclosed his personal information to the College of Physicians and Surgeons (the College) 
without his consent. 


In May 1994, the complainant had filed a complaint with the College. In his complaint, he had 
alleged that the physician had verbally abused him, had conducted an improper examination and 
had not been qualified to examine him because the physician was not a neurosurgeon. 


After receiving the formal complaint, the College had written to the physician on June 17, 1994 
stating: 


I would advise that you make written submissions for the Committee’s 
consideration within (30) days of receipt of this letter. Under the Regulated 
Health Professions Act, the College should obtain all records and documents 
relating to a complaint. Therefore, should you decide to revise your written 
response to [the named complainant’s] allegation as outline above, it would be 
appreciated if you forward a copy of your office records relative to the 
complainant’s allegations. 


On July 8, 1995 the physician submitted a response to the College which included photocopies 
of the relevant reports and memos from the complainant’s file. 


The complainant was of the view that the physician should not have disclosed his medical 
information to the College and that his rights under the Freedom of Information and Protection 
of Privacy Act (the Act) had been violated. 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) | Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the disclosure of the complainant’s personal information in compliance with 
section 42 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(h) the individual’s name where it appears with other personal 
information relating to the individual or where the disclosure of the 
name would reveal other personal information about the individual; 


The information in question included the complainant’s name together with his medical 
information. Therefore, it is our view that this information met the requirements of paragraph 
(h) of the definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Was the disclosure of the complainant’s personal information in compliance 
with section 42 of the Act? 


Section 42 of the Act sets out the rules for disclosure of personal information other than to the 
individual to whom the information relates. This section provides that an institution shall not 
disclose personal information in its custody or under its control, except in the circumstances 
listed in sections 42(a) through (n). 


Section 42(c) of the Act states: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(c) for the purpose for which it was obtained or compiled or for a 
consistent purpose; 


Section 43 of the Act further provides that: - 
Where personal information has been collected directly from the individual to 
whom the information relates, the purpose of a use or disclosure of that 


information is a consistent purpose under clauses 41(b) and 42(c) only if the 
individual might reasonably have expected such a use or disclosure. 
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The Board submitted that the disclosure of the complainant’s personal information was in 
compliance with section 42(c) of the Act. The Board stated that in June 1992, the complainant 
had been examined by the physician and a medical report had been filed in the complainant’s 
claim file. The report had been used by the Board to determine the complainant’s entitlement 
to benefits under the Workers’ Compensation Act (the WCA). 


The Board stated that after the complainant had complained to the College, the physician had 
sent a response to the College which included reports and memos from the complainant’s file. 
It was the Board’s view that it was reasonable for the physician to disclose relevant information 
about the complainant to the College since it had requested copies of the physician’s office 
records relative to the complainant’s allegations. 


In addition, the Board stated that if the physician had not respond in this manner, he/she would 
have been guilty of a professional misconduct under section 30 of the Regulated Health 
Professions Act which requires a physician to respond appropriately to a written inquiry from 
the College. 


It was the Board’s view that, therefore, the physician needed to disclose the complainant’s 
personal information to the College in order to provide a full and complete response to the 
complainant’s allegations. It was the Board’s position that it was reasonable for the complainant 
to have expected the disclosure of his personal information to the College and, therefore, the 
disclosure was for a consistent purpose. 


It is our view that one of the purposes for which the Board’s physician obtained the 
complainant’s personal information through the medical examination was to determine his 
entitlement to benefits under the WCA. 


The complainant had then filed a complaint with the College against the physician alleging that 
this medical examination had been improper and that the physician had not been qualified to 
examine him. 


It is our view that the physician’s subsequent disclosure of the complainant’s personal 
information to the College was to provide an appropriate and full response to the complainant’s 
allegations about the physician and the medical examination, thereby, enabling the College to 
proceed with its investigation of his complaint. It is also our view that having filed his 
complaint about the physician with the College, it was reasonable for the complainant to have 
expected that the physician would have to disclose relevant details of the medical examination 
and/or other medical information to the College. Therefore, the Board’s disclosure to the 
College was for a consistent purpose, in compliance with section 42(c) of the Act. 


Conclusions: The complainant’s personal information was disclosed in compliance with 
section 42 of the Act. 
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INTRODUCTION 


Background of the Complaint 
This investigation was initiated as a result of a complaint concerning a Municipality. 


The complainant had been in receipt of General Welfare Assistance (GWA) from the 
Municipality. The complainant stated, however, that in September 1994, he became employed 
with the Municipality as a Welfare Visitor. 


In December 1994, the Municipality terminated the complainant’s employment. In his letter of 
termination, the complainant’s Unit Manager stated that he had failed to declare assets resulting 
in his receiving general welfare assistance that he was otherwise not eligible for. The Unit 
Manager further stated that since the complainant’s position of Welfare Visitor required a high 
degree of integrity and financial trust, the complainant was deemed to be an “unsuitable 
probationary employee". 


The complainant subsequently filed a grievance. He stated that during the Step II grievance 
meeting, the Unit Manager claimed that she had received a telephone call from an employee of 
the Social Services Division who stated that the complainant had not declared all of his assets, 
resulting in his receiving GWA benefits that he was not eligible for. The complainant added that 
the Unit Manager claimed that she could not recall from whom she had received this telephone 
call. 


The complainant further stated that during the Step II grievance meeting, the Municipality’s 
Manager of Employee Relations stated that he had seen and read the contents of the 


complainant’s GWA file. 


The complainant believed that the disclosure of his personal information to his Unit Manager 
and the Manager of Employee Relations contravened the Municipal Freedom of Information and 


Protection of Privacy Act (the Act). 
Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) | Was the information in question “personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the complainant’s personal information disclosed to the Unit Manager, in 
compliance with section 32 of the Act? 


(C) Was the complainant’s personal information disclosed to the Manager of 
Employee Relations, in compliance with section 32 of the Act? 
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RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an_ identifiable 
individual, including, 


(a) information relating to the ... marital or family status of the individual, 


(b) information relating to the education or the medical, psychiatric, 
psychological, criminal or employment history of the individual or 
information relating to financial transactions in which the individual has 
been involved; 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The information in question was that the complainant had allegedly not declared all of his assets, 
resulting in his receiving GWA benefits that he was not entitled to. 


It also included information contained in the complainant’s GWA file, such as information about 
the complainant’s rent, medical and resident status, last employment, last source of income and 
current and expected income, and family size and relationship. It also included "flyleaf entries" 
from the "Income Maintenance/Eligibility Record", which recorded all communications between 
the complainant and his Welfare Visitor. 


In our view, this information met the requirements of paragraphs (a), (b) and (h) of the 
definition of "personal information" in section 2(1) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Was the complainant’s personal information disclosed to the Unit Manager, 
in compliance with section 32 of the Act? 

As previously mentioned, the complainant stated that during the Step II grievance meeting, the 

Unit Manager claimed that she had received a telephone call from an employee of the Social 

Services Division who stated that the complainant had not declared all of his assets, resulting 

in his receiving benefits that he was not eligible for. The complainant added that the Unit 

Manager claimed that she could not recall from whom she had received this information. 
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Under the Act, personal information in the custody or under the control of an institution cannot 
be disclosed except in the specific circumstances outlined in section 32. 


The Municipality submitted that on August 10, 1994, a letter was received from the complainant, 
in which he had complained about his Caseworker/Welfare Visitor. The Municipality added that 
a Staffing Co-ordinator subsequently investigated these complaints, and during the investigation 
"concerns were raised because the complainant was a temporary probationary employee and 
registered as being currently in receipt of assistance." 


As a result of the above concerns, the Municipality’s Fraud and Investigations Unit investigated 
the matter, and determined that the complainant had received benefits to which he was not 
entitled. The Municipality’s Freedom of Information and Privacy Co-ordinator stated that it was 
the Fraud and Investigations Unit of the Social Services Division that had advised the 
complainant’s Unit Manager of its findings. 


The Municipality submitted that: "Consistent with s.32 (d) of the Act, (the named Unit 
Manager) was advised of the outcome of the investigation as it had a direct bearing on the 
employee-employer relationship." 


The Municipality also indicated that the Unit Manager had provided the complainant with a letter 
setting out the reasons for termination, "in accordance with her responsibilities as Unit 
Manager". 


Section 32(d) of the Act states that an institution shall not disclose personal information in its 
custody or under its control except: "if the disclosure is made to an officer or employee of the 
institution who needs the record in the performance of his or her duties and if the disclosure is 
necessary and proper in the discharge of the institution’s functions." 


In our view, the Unit Manager would have needed the complainant’s personal information in the 
performance of her duties as a manager, namely, being aware of incidents affecting the 
employment status of a subordinate employee. It is also our view that disclosing this 
information was necessary and proper in discharging the institution’s function of human resource 
management. It is our view, therefore, that the disclosure of the complainant’s personal 
information to the Unit Manager, an employee of the Municipality, was in compliance with 
section 32(d) of the Act. 


Conclusion: The complainant’s personal information was disclosed to the Unit 
Manager, in compliance with section 32 of the Act. 


Issue C: Was the complainant’s personal information disclosed to the Manager of 
Employee Relations, in compliance with section 32 of the Act? 


The Municipality stated that the Manager of Employee Relations was responsible for 
representing the Municipality at grievance and arbitration hearings, wrongful dismissal actions, 
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human rights investigations, etcetera, involving employees from the complainant’s department. 
The Municipality further stated that the complainant’s union’s position was that the hiring 
process of the complainant was irregular and improper, the fraud investigation was inadequate, 
and the termination was discriminatory. 


The Municipality submitted that in preparing for the Step II grievance meeting, the Manager of 
Employee Relations “obtained copies of the records which would be relied upon during the 
grievance process." The Municipality stated that the Manager of Employee Relations required 
access to these records in order to represent the Municipality’s position in respect of these 
matters. 


While the complainant contended that the Manager of Employee Relations had stated, during the 
Step II meeting, that he had seen and read the contents of his GWA file, the Municipality 
submitted that the Manager of Employee Relations had seen a total of only 22 pages from the 
complainant’s GWA file. 


The complainant provided us with a copy of the notes recorded by his union representative 
during the Step IJ meeting. The notes did not indicate that the Manager of Employee Relations 
had seen and read the contents of the complainant’s GWA file. We also spoke with the union 
representative. She stated that she could neither confirm nor deny that the Manager of 
Employee Relations had said this. 


Since the complainant’s and the Municipality’s accounts of what was said by the Manager of 
Employee Relations during the Step II meeting differ, we are unable to conclude whether or not 
the Manager of Employee Relations had seen and read the entire contents of the complainant’s 
GWA file. 


The Municipality, however, did provide us with a copy of the aforementioned 22 pages, which 
consisted of 17 pages of flyleaf entries from the "Income Maintenance/Eligibility Record"; an 
"Eligibility Assessment Sheet"; a letter written by the complainant to an Area Office Manager 
complaining about his Caseworker and the Area Office Manager’s reply; and a one-page 
document containing information under the headings: "Referral Date", "Client Data", 
"Disentitlement Data", and "Evidence". The Municipality’s Freedom of Information and 
Privacy Co-ordinator stated that the Manager of Employee Relations had both requested and 
received these records from the aforementioned Area Office Manager to whom the complainant 
had complained about his Caseworker. 


The Municipality relied on section 32(d) of the Act for the disclosure of the complainant’s 
personal information to the Manager of Employee Relations (for the complete text of section 
32(d) see Issue B). = 


In our view, one of the Municipality’s functions as an employer is to respond to grievances 
made by one of its employees. 
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The Manager of Employee Relations was the Municipality employee who was responsible for 
representing the Municipality’s interests at the Step II meeting. The Municipality took the 
position that in order to adequately prepare for the Step II meeting, the Manager of Employee 
Relations had to be aware of any information that the Municipality might be required to respond 
to during the meeting. 


Based on all of the above, it is our view that section 32(d) of the Act applies in the 
circumstances of this case. The complainant’s personal information, which was contained in the 
22 pages in question, was disclosed to the Manager of Employee Relations, an employee of the 
Municipality, who needed this information in the performance of his duties, and the disclosure 
was necessary and proper in the discharge of one of the Municipality’s functions, i.e., 
participating in a grievance meeting to which it was a party. 


Conclusion: Since the complainant’s and the Municipality’s accounts of what was said 
by the Manager of Employee Relations during the Step II meeting ‘differ, 
we are unable to conclude whether or not the Manager of Employee 
Relations had seen and read the entire contents of the complainant’s GWA 
tile? 


The complainant’s personal information, which was contained in the 22 


pages in question, was disclosed to the Manager of Employee Relations, 
in compliance with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
Act. 
e The complainant’s personal information was disclosed to the nad Manager, in 


compliance with section 32 of the Act. 


e Since the complainant’s and the Municipality’s accounts of what was said by the Manager 
of Employee Relations during the Step II meeting differ, we are unable to conclude 
whether or not the Manager of Employee Relations had seen and read the entire contents 
of the complainant’s GWA file. 


e The complainant’s personal information, which was contained in the 22 pages in 
question, was disclosed to the Manager of Employee Relations, in compliance with 
section 32 of the Act. 


Original signed by: June 15, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a privacy complaint concerning a separate school 
board (the Board). The privacy complaint was made by one of the Board’s teachers. 


Some students had complained to the Board about this teacher. They were concerned that the 
remarks the teacher had made in history class reflected an anti-Catholic/anti-Christian viewpoint. 


The Board’s Human Resources Committee met in-camera to discuss the students’ complaints 
against the teacher. A background package prepared for the Committee members attending the 
in-camera meeting included copies of the students’ complaints against the teacher, and transcripts 
of remarks the teacher was alleged to have made in class. 


After the meeting, one of the Board’s trustees, who had attended the meeting even though she 
was not a committee member, forwarded the package to the Archbishop, who was the local 
diocesan bishop. According to the Board’s initial representations, the trustee wanted to obtain 
the Archbishop’s opinion on the matter to assist herself and the Board when the matter came 
before the Board for a decision. 

The complaint against the teacher was subsequently resolved without the intervention of the 
Archbishop, with a finding that the teacher’s remarks had been appropriate in the context in 
which they had been made. 


The teacher complained that the disclosure to the Archbishop had breached the Municipal 
Freedom of Information and Protection of Privacy Act (the Act). 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) — Did the records in question contain the complainant’s "personal information" as 
defined in section 2(1) of the Act? If yes, 


(B) Was the personal information disclosed to the Archbishop in compliance with the 
Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Did the records in question the contain the complainant’s "personal 
information" as defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, 
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(g) the views or opinions of another individual about the individual, and 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The records in question contained the teacher’s name, together with the written complaint made 
against him by the students, and the students’ names. The Board indicated that the records in 
question contained the personal information of the teacher. It is our view that the records in 
question contained both the teacher’s and the students’ personal information, as defined in 
sections 2(1)(g) and (h) of the Act. 


Conclusion: The records in question contained personal information as defined in 
section 2(1) of the Act. 


Issue B: Was the personal information disclosed to the Archbishop in compliance with 
the Act? 


In our draft report, based on the Board’s original representations, the discussion of this issue was 
as follows: 


The Board took the position that the disclosure to the Archbishop had been made 
in compliance with the Act. The Board relied on sections 32(d) and 32(c) of the 
disclosure provisions of the Act. 


Section 32(d) of the Act states in part: 


An institution shall not disclose personal information in its custody or under its 
control except, 


(d) if the disclosure is made to an officer or employee of the institution who 
needs the record in the performance of his or her duties and if the 
disclosure is necessary and proper in the discharge of the institution’s 
functions; 


The Board submitted that the personal information had been disclosed by the 
trustee to the Archbishop in his capacity as Honourary Director of Education and 
as the local diocesan bishop in the area. The trustee’s intent was to seek 
assistance in making a decision regarding the students’ complaints about the 
teacher. The Board, however, did not explain why the Archbishop needed to 
know the identity of the teacher (or of the students), in order to give an opinion 
on the subject. 


Further, the Board informed us that the Archbishop had stated in his response to 
the trustee’s communications that there were other steps that should be taken prior 
to his involvement in the matter. The Board acknowledged that the trustee did 
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not follow proper procedures for communicating with the Archbishop on Board 
related business. The Board stated that it had later advised the trustee that she 
should initiate such communications either through the Chair of the Board or 
through the Board, by way of motion. The students’ complaints were eventually 
resolved by the Board without the Archbishop’s involvement. 


While there may be circumstances where the Archbishop may require disclosure 
of personal information in the performance of his duties, on the basis of the 
Board’s submissions, we must conclude that in this case, the Archbishop did not 
need the personal information in the performance of his duties and that the 
disclosure was not necessary and proper in the discharge of the Board’s functions. 
Accordingly, we are of the view that the disclosure was not in compliance with 
section 32(d) of the Act. 


The Board also submitted that the disclosure was in compliance with section 
32(c), for a consistent purpose. Section 32(c) of the Act states in part: 


32. An institution shall not disclose personal information in its custody or 
under its control except, 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


Section 33 of the Act states: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. [emphasis added] 


In this case, the teacher’s personal information had been collected indirectly (i.e. 
from the students). Therefore, the teacher’s reasonable expectations could not be 
a factor in determining consistent purpose. Where there has been an indirect 
collection of personal information, in order for the disclosure to have been made 
for a consistent purpose, the purpose for which the personal information was 
disclosed must be reasonably compatible with the purpose for which the personal 
information was obtained or compiled by the Board. 


It was the Board’s view that it had obtained the personal information for the 
purpose of investigating and resolving the students’ complaints. However, the 
trustee’s decision to disclose the personal information was, on the face of the 
Board’s submissions, incompatible with the Board’s own purposes, which at no 
point contemplated a trustee disclosing this information to the Archbishop. The 
Board stated that other authorized channels were available for consulting with the 
Archbishop if the Board had deemed that necessary (which it did not in this case). 


[IPC Investigation 195-008M/July 21, 1995] 


45 


As previously stated, the matter was resolved without the intervention of the 
Archbishop. 


Taking all of this into account, we find that the purpose for which the trustee 
disclosed the personal information was not compatible with the purpose for which 
the Board obtained the personal information. Accordingly, we find that the 
disclosure was not made for a consistent purpose, and was thus not in compliance 
with section 32(c) of the Act. 


Therefore, in our draft report we concluded that the personal information in question had not 
been disclosed in compliance with the Act. 


However, at the same time that this case was before us, we received another complaint involving 
a disclosure of personal information by another trustee of the Board. In that case, the trustee 
had disclosed information about the employment benefits of a Board employee, by way of a 
press release. 


We found that in the particular circumstances of that case, the trustee had disclosed the 
information as an individual in his "political" capacity -- as an elected official communicating 
with his constituents. In our view, the trustee had not acted on behalf of, or as a representative 
of, the Board (the institution involved); he had acted as an individual. Since the Act applies only 
to the actions of institutions, we concluded that the Act did not apply. 


In its submissions on the draft report in the present case, the Board referred to this earlier 
complaint, stating that as a result of our findings in that case, regardless of its previous 
representations, the Board’s current position was that the trustee in this case: 


...18 not an Officer of the Board and has no power to act on behalf of the Board. 
At no time was the Trustee (named) directed by the Board to act on its behalf in 
this matter. The Trustee (named) was not seeking the opinion of the Archbishop 
in order to assist her and the Board in the decision making process. Rather, as a 
strong defender of the teachings of the Church, elected by her constituents to do 
so, she was individually, in her political capacity informing the Archbishop of the 
complaints in order to protect the faith and acting in the furtherance of her 
political role as guardian of the faith at the (named) Board. 


The Board stated that since it had not disclosed the information, the disclosure provisions of the 
Act did not apply. 


In our view, this case can be contrasted with the other case since the circumstances differ 
considerably. In this case, the trustee disclosed the information in order to obtain the 
Archbishop’s comments on the matter. Further, the trustee, as a member of the Board, intended 
to communicate those comments to the Board to assist it in its deliberations on the matter. We 
accept that the trustee may have been motivated to act as a "strong defender of the teachings of 
the Church." However, this does not change our view that the trustee was acting primarily as 
a member of the Board. Accordingly, we are not persuaded that the trustee was acting primarily 
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in a political capacity, as in the other case. 
Having considered the initial and subsequent representations from the Board, we remain of the 
view that the disclosure was not in compliance with the Act for the reasons contained in our 


draft report, cited above on pages two to four. 


Conclusion: The personal information in question was not disclosed in 
compliance with section 32 of the Act. 


SUMMARY OF CONCLUSIONS 


e The records in question contained personal information as defined in section 2(1) of the 
Act. 

° The personal information in question was not disclosed in compliance with section 32 of 
the Act. 

RECOMMENDATION 


We recommend that the Board remind relevant staff and trustees that personal identifiers should 
be severed before disclosing records containing personal information, where the identity of the 
individual(s) is not required by an officer or employee of the Board in the performance of his 
or her duties. . 


Within six months of receiving this report, the Board should provide the Office of the 
Information and Privacy Commissioner with proof of compliance with the above 
recommendation. 


Original Signed by: July 21, 1995 
Ann Cavoukian, Ph.D. Date 


Assistant Commissioner 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning a public board of education 
(the Board). The complainants are the mother and father of one of Board’s eight-year-old 
students. In this case, the husband is representing his wife as her agent. 


Over time, there had been several incidents at school that involved altercations between the 
complainants’ child and other children. The parents were concerned about these incidents, and 
had ongoing contact with Board staff in attempts to resolve the matter to their satisfaction. 


On March 8, 1994, the complainant (the father) wrote to the Board’s Director of Education (the 
Director), requesting that the Director meet with him and his wife on March 10, 1994. The 
letter stated: 


...1 am looking forward to this opportunity to have private meeting between the 
three of us, at which time I hope that a number of issues can be removed from 
the table. 


I have included a series of questions for your perusal that form the basis of some 
of our concerns about the administration of [a named school]. I will not be 
pressing you to provide any feedback on these questions in our meeting but these 
questions are amongst those for which we would be seeking answers if we were 
forced to escalate our issues with [the school]. I am requesting that the enclosed 
information not be distributed to anyone else without my permission. 


The enclosure contained a list of thirteen questions related to the altercations between the 
complainants’ child and other children. The majority of the questions dealt with the responses 
of officials of the Board to concerns that were raised by the complainant and his wife. 


On April 7, 1994, the Director wrote to the complainant, enclosing written answers to the 
questions. The Director’s letter referred to the meeting of March 10, and stated: 


I outlined to you on that date that it would take me a few weeks to have staff 
review the questions raised because of the two-week March Break. That review 
has taken place and I am providing to you, with this letter, answers to each of 
your questions, as provided to me following the review. 


The complainants concluded from this letter that the questions had been disclosed to Board staff 
other than the Director. They believed that such disclosures would have breached the Municipal 


Freedom of Information and Protection of Privacy Act (the Act). 


The Board acknowledged that the questions had been disclosed to Board staff other than the 
Director, but took the view that the disclosures had been in compliance with the Act. 
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Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


ea] 


(A) Did the list of questions contain the complainants 
defined in section 2(1) of the Act? 


personal information", as 


(B) If yes, was the "personal information" disclosed in compliance with the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Did the list of questions contain the complainants’ "personal information", 
as defined in section 2(1) of the Act? 


Section 2(1) of the Act defines "personal information" as recorded information about an 
identifiable individual, including, 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; 


The list of questions related to several school incidents concerning the child, and the 
complainants’ attempts to resolve the matter with various school staff. The questions referred 
to both the complainants and their child by name. Therefore, it is our view that the questions 
contained the personal information of the complainants and their child, as defined in section 
2(1)(h) of the Act. 


Conclusion: The questions contained the personal information of the complainants and their 
child, as defined in section 2(1)(h) of the Act. 
Issue B: Was the "personal information" disclosed in compliance with the Act? 
Section 32 of the Act sets out the various circumstances under which an institution under the Act 
may disclose personal information. Section 32 of the Act states in part: 
An institution shall not disclose personal information in its custody or under its 
control except, 
(b) if the person to whom the information relates has identified 


that information in particular and consented to its 
disclosure; 
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In the circumstances of this case, the complainant had identified the information in particular 
(the questions), at the time he wrote his letter, and had not consented to its disclosure. The 
Board acknowledged that in the complainant’s letter, he had requested that the enclosed 
information not be distributed to anyone else without his permission. Nevertheless, the Director 
had disclosed the information to other Board staff. It is our view that such a disclosure would 
not have been in compliance with section 32(b) of the Act. However, section 32(b) is only one 
of several sections permitting the disclosure of personal information which must be considered 
in this case. 


Despite its acknowledgment on the issue of (non) consent, the Board indicated that it believed 
that the disclosures had been in compliance with sections 32(c) and 32(d) of the Act. Therefore, 
we have examined whether these, or any other sections of the Act which permit disclosure, 
apply in the circumstances of this case. 


Sections 32(c) and 32(d) state: 


An institution shall not disclose personal information in its custody or under its control 
except, 


(c) for the purpose for which it was obtained or compiled or 
for a consistent purpose; 


(d) if the disclosure is made to an officer or employee of the 
institution who needs the record in the performance of his 
or her duties and if the disclosure is necessary and proper 
in the discharge of the institution’s functions; 


The Board’s view was that the disclosure had been made for a consistent purpose. Since the 
information in question was collected directly from the complainant, section 33 of the Act, 
which defines consistent purpose, applies. Section 33 of the Act states: 


The purpose of a use or disclosure of personal information that has been collected 
directly from the individual to whom the information relates is a consistent 
purpose under clauses 31(b) and 32(c) only if the individual might reasonably 
have expected such a use or disclosure. [emphasis added] 


In other words, the complainant would have had to reasonably expect the disclosure in order 
for the disclosure to have been made for a consistent purpose, in compliance with the Act. The 
evidence we have received on this matter from the Board and the complainant is contradictory. 
The parties to the meeting of March 10 appeared to have come away from the meeting with 
different views of what should happen next concerning the complainant’s questions. 
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The complainant maintains that at no time during the meeting did the Director indicate that he 
would have his staff review the questions. He also states that during the March 10 meeting, that 
they (himself, his wife and the Director) had collectively agreed to put a number of items aside, 
including the issues that were contained in the series of questions. In response to our draft 
report, the complainant re-iterated his view that the items outlined in the questions had been 
removed from the table and that the Director had no reason or permission to pursue them any 
further. 


As we Stated in our draft report, if the issues had already been resolved, or put aside, then in 
the complainant’s view, there would have been no reason for his questions to be answered, and 
thus no reasonable expectation of disclosure on his part. If we were to take only the 
complainant’s position into account, our view would be that the disclosure was not made for 
a consistent purpose, in compliance with section 32(c) of the Act, since there was no reasonable 
expectation on the part of the complainants. 


The Act also provides under section 32(c) that personal information may be disclosed for the 
purpose for which it was obtained or compiled. Therefore, in drawing our conclusions, we also 
considered the Director’s view of how the meeting ended, and his view of the Board’s purpose 
for which the personal information had been obtained, since his actions following the meeting 
are the focus of this complaint. In contrast to the complainant’s view, the Director’s letter of 
April 10 indicated that he had "outlined" to the complainant that subsequent to the March 10 
meeting, he would be taking steps to answer the complainant’s questions, and that to do so, he 
would be seeking input from Board staff. The Board’s submission further indicated that it was 
the Director’s opinion that the serious nature of the questions did require an answer, and that 
the questions were not posed on a purely rhetorical basis. The Board’s view was that it was 
acting responsibly in trying to provide accurate responses to the questions posed by the 
complainant. 


The complainant’s letter of March 8 states that he had “included a series of questions for [the 
Director’s] perusal that form the basis of some of our concerns". It appears, then, that the 
complainant was anxious that the Director acquaint himself with those concerns. In our view, 
there would have been no constructive purpose in the complainant’s providing the questions 
outlining his concerns to the Director unless he desired the Director to take some action to 
resolve those concerns. It is our understanding that the complainants sincerely wanted the 
problem to be resolved. 


In the circumstances of this case, the action taken by the Director following the meeting with 
the complainants, is at issue. Therefore, having considered the complainant’s views, we also 
took into account what the Director believed to be the case at the time the meeting ended. In 
the Director’s view, despite the fact that the complainant’s letter requested non-disclosure of the 
questions, the meeting had ended with agreement that the Director would find answers to the 
questions, and report back to the complainant. The Director’s course of action in disclosing the 
questions to his staff, and writing to the complainant with the answers, is consistent with that 
view, although it is not the same view the complainants may have had when the meeting ended. 


It is our view that the personal information was obtained and disclosed for the same purpose - 
to bring the complainant’s concerns to the attention of Board staff, and to resolve the issues the 
complainant had raised in his questions. Therefore, we are of the view that the personal 
information was disclosed in compliance with section 32(c) of the Act. 
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The complainant submitted that the information was compiled by himself, his wife, and. his 
lawyer, for submission to the Ministry of Education, and that his purpose in providing the 
questions to the Director was to show him what issues, in part, would be escalated to the 
Ministry of Education. We are of the view that while this may have been the complainant’s 
purpose in providing the questions, the Director’s view was that he had received the questions 
in order to answer them, and he took action accordingly. Therefore, we remain of the view 
that the disclosure to staff was in compliance with section 32(c) of the Act, for the purpose for 
which the personal information was obtained. 


The Board also submitted that the disclosures to staff were in compliance with section 32(d) of 
the Act, which permits disclosure to employees who need the record in the performance of their 
duties. The Board indicated that the questions had been disclosed only to the following Board 
staff: the Superintendent of Schools and the child’s school Principal, because they were the 
individuals who knew the answers to, and could appropriately respond to the questions, and the 
Director’s Executive Secretary, who handled all confidential matters for the Director and who 
prepared the Director’s response in this case. 


In response to our draft report, the complainant submitted that there was a discrepancy between 
the above list of individuals the Board had provided to our office, and the list the complainant 
had been provided by the Board’s Chair. We were aware of this discrepancy at the time we 
issued our draft report. However, we are satisfied with the expanded list of individuals provided 
to us for the purpose of this investigation. 


We Stated in our draft report that the individuals listed above would have had to know what the 
questions were in order to be able to answer them, or to prepare the Director’s reply. The 
complainant submitted that "...there is no justification for releasing any section of my 
information to an employee who is not able to supply the required information nor in a position 
to evaluate the conduct of a person named in those questions". The complainant is in effect, 
saying that only certain questions should have been provided to the Superintendent and Principal. 


In our view, disclosure of the personal information contained in the questions to an employee 
who did not need the record in the performance of his duties would be a breach of section 32(d) 
of the Act. In the circumstances of this case, the complainant has stated in his comments on our 
draft report that the majority of his questions were about responses from officials of the Board. 
Both the Principal and Superintendent involved are Board officials whose conduct is at issue. 
It is our understanding that there is a reporting relationship between these two individuals. 


It is our view that in certain circumstances, an appropriate approach would have been to provide 
only certain questions to these employees. However, it is also our view that the complete 
context and breadth of the questions would have been important for both the Superintendent and 
Principal to understand, given the serious nature of the complainant’s concerns, and the fact that 
both would have to deal with the situation in the future. 


Therefore, we remain of the view that the disclosures to the above employees were in 
compliance with section 32(d) of the Act. 


We are also of the view that no other sections of the disclosure provisions of the Act apply to 
the disclosures in question. 
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Conclusion: The personal information was disclosed in compliance with sections 32(c) 
and (d) of the Act. 


SUMMARY OF CONCLUSIONS 


° The questions contained the personal information of the complainants and their child, as 
defined in section 2(1)(h) of the Act. 


e The personal information was disclosed in compliance with sections 32(c) and (d) of the 
Act. 

Onginal signed by: June 7, 1995 

Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 


This investigation was initiated as a result of a complaint concerning the Ministry of Housing, 
now the Ministry of Municipal Affairs and Housing (the Ministry). 


The complainant, an employee of the Ministry, had lodged a complaint with the Ministry 
regarding the actions of two of its directors. The Ministry had appointed an investigator from 
Management Board (the Investigator) to look into her complaint. The complainant’s letters about 
her complaint had then been disclosed by the Ministry to the Investigator. 


The complainant stated that, at the time of the disclosure, she and the Ministry had not yet 
agreed about whether the Investigator would be the individual assigned to her complaint. The 
complainant stated that, since another individual was subsequently appointed instead of the 
Investigator "to hear other concerns which would have included the one [the Investigator] was 
asked to investigate", her personal information had been prematurely sent to the Investigator, 
without her consent. 


The complainant was concerned that the Ministry’s disclosure of her personal information to the 
Investigator had been contrary to the Freedom of Information and Protection of Privacy Act (the 
Act). 

Issues Arising from the Investigation 


The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information", as defined in section 2(1) 
of the Act? If so, 


(B) Was the Ministry’s disclosure of the personal information in compliance with 
section 42 of the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information", as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states that personal information means recorded information about an 
identifiable individual, including, 


(h) the individual’s name where it appears with other personal information 
relating to the individual... 


The information in question was contained in the complainant’s letters, and included the 
complainant’s name together with information about her complaint against the two directors. 
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It is our view that the information in question met the requirements of paragraph (h) of the 
definition of personal information in section 2(1) of the Act. 


Conclusion: The information in question was personal information as defined in section 
2(1) of the Act. 


Issue B: Was the Ministry’s disclosure of the personal information in compliance with 
section 42 of the Act? 


The complainant stated that her personal information had been prematurely sent to the 
Investigator since an agreement about whom the assigned investigator would be had not been 
reached and since another individual was subsequently appointed to investigate. When the 
Investigator was assigned to look into the complaint, the complainant initially objected to her 
being selected. The complainant, however, later stated in a letter to the Deputy Minister (the 
DM) that, while it was her belief that the process was not impartial because of the particular 
investigator assigned,"as my Deputy, your decision in this matter is respected." 


The complainant also stated that in a subsequent discussion with the Ministry, the Assistant 
Deputy Minister (the ADM) suggested that she prepare and send him her own release form for 
the disclosure of the information in question to the Investigator, but she did not do this. The 
complainant stated that, since the ADM had requested that she take this action "after-the-fact", 
he was aware that a violation of her privacy had taken place at the time the information had been 
disclosed to the Investigator. 


Under the Act, personal information cannot be disclosed except in the specific circumstances 
outlined in section 42 of the Act. 


The Ministry stated that it had relied upon sections 42(c) and 42(d) of the Act for its disclosure 
of the personal information in question. Section 42(c) states that "an institution shall not disclose 
personal information in its custody or under its control except," 


(c) for the purpose for which it was obtained or compiled or for a consistent 
purpose; 


The Ministry advised us that the complainant had made some very serious allegations about the 
actions of the two directors. In a letter to the Ministry dated May 24, 1994, the complainant 
had stated that her complaint warranted the intervention of the DM. According to the Ministry, 
the complainant had, both verbally and by electronic mail, notified the Ministry that she wanted 
the complaint either to be directed back to her director or to have an independent investigator 
assigned. 


On June 2, 1994, the DM wrote to the complainant advising her that a formal review of the 
matter would take place. He stated that he would arrange for someone to review these matters 
and report to him with findings and recommendations. On June 20, 1995, the DM notified the 
complainant that the Investigator had been assigned to conduct the investigation. 
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The Ministry stated that "it was never held out to [the complainant] that there would be an 
‘agreed’ upon investigator or protocol for the investigation." The Ministry stated that it was the 
prerogative of the DM, as the person having charge of the administrative affairs of the Ministry, 
to cause investigations to be conducted when allegations such as those made by the complainant 
were made. As well, the complainant had asked that the Ministry assign an independent 
investigator. 


When the complainant’s personal information was disclosed to the Investigator, it was the 
intention of the DM that the Investigator would be the individual who would conduct an 
investigation into the complainant’s allegations. Some preliminary work was done by the 
Investigator and it was not until April 1995 that another person was assigned to look into other 
matters concerning the complainant, as well as to investigate her complaint about the directors. 


The Ministry stated that under section 42(c) of the Act, the Ministry’s disclosure to the 
Investigator was consistent with the purpose of having the matter reviewed, which was the 
reason the complainant wrote to the Ministry. The Ministry suggested that it should have been 
foreseeable by the complainant that her personal information would have to be reviewed in any 
investigation that took place. The Ministry stated that the disclosure of the complainant’s 
personal information was, thus, in compliance with section 42(c) of the Act. 


In our view, the Ministry obtained or compiled the complainant’s personal information for the 
purpose of dealing with the complaint she had lodged against the two directors. The DM, being 
responsible for the administrative affairs of the Ministry, determined that the allegations made 
by the complainant warranted an investigation and had, thus, arranged for the Investigator to 
deal with her complaint by reviewing the matter and reporting to him. It is our view that the 
DM was not required to obtain the complainant’s agreement about whom the assigned 
investigator would be. Further, the complainant had stated that she respected the DM’s decision 
in the matter of his selection of the Investigator. 


The complainant stated that, while she understood that it might have been necessary for 
information about her complaint to be forwarded to the Investigator, her actual complaint letters 
to the Ministry should not have been sent. However, it is our view that the Ministry disclosed 
the complainant’s actual documents containing her personal information to the Investigator for 
the purpose of ensuring that the Investigator, who had been assigned to deal with this complaint, 
would conduct a thorough and accurate investigation and that, ultimately, an appropriate and full 
response to the complainant’s allegations would be provided. It is, thus, our view that the 
Ministry’s disclosure of the complainant’s personal information to the Investigator was for the 
purpose for which the information was obtained or compiled, i.e. to deal with the complaint, 
in compliance with section 42(c) of the Act. 


Since the Ministry’s disclosure of the complainant’s personal information was in compliance with 
section 42(c) of the Act, we did not address the application of section 42(d) of the Act. 


Conclusions: The complainant’s personal information was disclosed in compliance with 
section 42 of the Act. 
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SUMMARY OF CONCLUSIONS 


e The information in question was personal information as defined in section 2(1) of the 
Act. 

e The complainant’s personal information was disclosed in compliance with section 42 of 
the Act. 

Original signed by: August 25, 1995 

Susan Anthistle Date 


Compliance Review Officer 
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INTRODUCTION 


Background of the Complaint 
This investigation was initiated as a result of a complaint concerning a Municipality. 


The complainant is a former employee of the Municipality’s housing corporation. In a letter 
dated March 9, 1994, the complainant’s then District Manager referred to the complainant’s 
inability to work harmoniously with her colleagues and her work history of "conflict, disruption 
and turmoil," and requested that she obtain a medical certificate attesting to her "psychological 
and emotional competence." While the complainant refused to provide the medical certificate, 
she nonetheless questioned the Municipality’s authority to collect this information. 


In July 1994, the Municipality terminated the complainant’s employment, and the complainant 
subsequently applied for unemployment insurance (UI) benefits. In a hearing to determine the 
complainant’s eligibility for benefits, a Board of Referees for Employment and Immigration 
Canada (EIC) referred the matter back to the EIC with a request that it obtain more details about 
the complainant’s confrontational style and her inability to work harmoniously with her 
colleagues. 


In response to this request, the Municipality provided the EIC with a copy of a decision of the 
Ontario Labour Relations Board (the OLRB), which was made further to an application brought 
to the OLRB by the complainant regarding her union. The complainant submitted that because 
the OLRB’s decision was irrelevant to the EIC’s request, the Municipality’s disclosure of it 


violated the Municipal Freedom of Information and Protection of Privacy Act (the Act). 

As well as being an employee, the complainant was also a tenant of the Municipality’s housing 
corporation. She stated that the following documents relating to her employment with the 
Municipality were delivered to her home in an unsecured fashion, in contravention of the Act: 
-- the aforementioned letter of March 9, 1994, 

-- a letter dated June 29, 1994 relating to the fact that the complainant had been suspended, 


the complainant’s letter of termination dated July 14, 1994, and 
-- the complainant’s 1992 OMERS pension statement. 


Issues Arising from the Investigation 
The following issues were identified as arising from the investigation: 


(A) Was the information in question "personal information" as defined in section 2(1) 
of the Act? If yes, 


(B) Was the Municipality’s proposed collection of the complainant’s personal 
information, in compliance with section 28(2) of the Act? 


(C) | Was the complainant’s personal information disclosed to the EIC, in compliance 
with section 32 of the Act? 
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(D) Was the complainant’s personal information protected by the Municipality, in 
compliance with the Act? 


RESULTS OF THE INVESTIGATION 


Issue A: Was the information in question "personal information" as defined in section 
2(1) of the Act? 


Section 2(1) of the Act states, in part: 


"personal information" means recorded information about an identifiable 
individual, including, 


(a) information relating to the race, national or ethnic origin, colour, religion, 
age, .. 


(c) any identifying number, symbol or other particular assigned to the 
individual, 


(h) the individual’s name if it appears with other personal information relating 
to the individual or where the disclosure of the name would reveal other 
personal information about the individual; [emphasis added] 


The information that the Municipality had intended to obtain was a medical certificate attesting 
to the complainant’s psychological and emotional competence. In our view, this information 
would have met the requirements of paragraph (h) of the definition of "personal information" 
in section 2(1) of the Act. 


The information in question also included information contained in the decision of the OLRB, 
which was: 


-- the complainant’s name, 

-- a description of the complainant’s application to the OLRB and the remedies she had 
sought, and the OLRB’s decision in this regard, 

-- a description of the incidents about which the complainant had or had not filed 
grievances, and 

-- details of an "arrangement" the complainant’s union had negotiated with the Municipality 
respecting the complainant’s suspension grievance, and the fact that the complainant had 
rejected this arrangement. 


It is our view that this information met the requirements of paragraph (h) of the definition of 
"personal information” in section 2(1) of the Act. 
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The information in question also included the March 9, June 29, and July 14, 1994 letters 
concerning the complainant’s employment, and the complainant’s 1992 OMERS pension 
statement, which contained her age, social insurance number and pension information. In our 
view, this information met the requirements of paragraphs (a), (c) and (h) of the Act. 


Conclusion: The information in question was "personal information" as defined in 
section 2(1) of the Act. 


Issue B: Was the Municipality’s proposed collection of the complainant’s personal 
information, in compliance with section 28(2) of the Act? 

While the Municipality did not actually collect any information with regard to this incident, it 

had intended to collect a medical certificate from the complainant attesting to her psychological 

and emotional competence. 


Section 28(2) of the Act states: 


No person shall collect personal information on behalf of an institution unless the 
collection is expressly authorized by statute, used for..the purposes of law 
enforcement or necessary to the proper administration of a lawfully authorized 
activity. (emphasis added) 


The Municipality submitted that its proposed collection of the medical certificate was necessary 
to the proper administration of a lawfully authorized activity. It stated: "the request for a 
medical certificate was necessary in order for (the named housing corporation) to carry out its 
role in managing staff." i“ 


The Municipality explained that the complainant was given the option of obtaining the medical 
certificate from a medical practitioner of her choosing. It added, however, that if the 
complainant had failed to provide the medical certificate within the required deadline, the 
housing corporation would have made an appointment with the Municipality’s Occupational 
Health, Safety and Rehabilitation Division, as per Article 39 of the collective agreement between 
the housing corporation and the complainant’s union. 


Article 39 states that the housing corporation shall adopt or agree to a rehabilitation policy the 
same as the Municipality’s. 


The Municipality provided us with a copy of its rehabilitation policy, which consists, in part, 
of a memorandum dealing with "Absenteeism and Poor or Declining Performance." In the 
memorandum, the following is stated: 


If however, the employee’s performance and/or attendance record are poor,,and 
the supervisor/manager feels there may be a medical problem, he/she may be 
referred to Employee Health Services under the following clause in the [named] 
Collective Agreement and [named] memorandum of understanding: 


"10:16 - That the [Municipality] may require any employee to submit to 
a medical examination by a physician designated by the [Municipality]." 
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We concur with the Municipality that managing staff is a lawfully authorized activity. It is also 
our view that in certain limited circumstances it is necessary for an employer to,obtain a medical 
assessment with respect to an employee who is exhibiting poor performance or attendance, and 
the supervisor or manager feels there may be a medical problem. Thus, assuming -- without 
deciding -- that the complainant’s behaviour was disruptive, we find that the proposed collection 
of the medical certificate would have been necessary in the circumstances. 


Conclusion: The Municipality’s proposed collection of the complainant’s personal 
information would have been in compliance with’section 28(2) of the Act. 


Issue C: Was the complainant’s personal information oe hoe to the EIC, in 
compliance with section 32 of the Act? 43) 


As previously mentioned, a Board of Referees for Employment and Immigration Canada (EIC) 
had referred the matter of the complainant’s eligibility for UI back to the EIC with a request that 
it obtain more details about the complainant’s confrontational style and her inability to work 
harmoniously with her colleagues. 


The Municipality stated that a copy of the Board of Referees’ request was sent to the housing 
corporation, and that, subsequently, the EIC contacted the housing corporation and asked for the 
additional details sought by the’ Board of Referees. THe’ Municipality stated that in replying to 
the request, the EIC was informed of the OLRB decision, a matter to which the complainant was 
a party, and the housing corporation an intervenor. The Municipality stated that the EIC then 
requested a copy of the OLRB decision, and the Municipality provided it with one. 


The Municipality submitted that its disclosure of thé OLRB decision to the EIC was in 
compliance with section 32(c) of the Act, which states: "An institution shall not disclose 
personal information in its custody or under its control except ... (c) for the purpose for which 
it was obtained or compiled or for a consistent purpose." 


The Municipality further submitted that: "... the complainant should reasonably have expected 
that, in view of the decision of the Board oF Referees to refer the matter back for further details 
on her style and behaviour, such pertinent information as the Ontario Labour Relations Board 
Decision would be disclosed to the Unemployment Insurance Commission (i.e., Employment and 
Immigration Canada)." 


In our view, the Municipality obtained or compiled the complainant’s personal information 
contained in the decision of the OLRB to deal with labour management issues arising out of its 
employment of the complainant. Since the Municipality disclosed the OLRB decision to the EIC 
further to the proceedings regarding the complainant’s eligibility for UI benefits, another labour 
;Management issue, it is our view that the Municipality disclosed the complainant’s personal 
rinformation for the "same purpose," in compliance with section 32(c) of the Act. 


Hs Conclusion: The complainant’s personal information was disclosed to the EIC, in 
compliance with section 32 of the Act. 
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Issue D: ~' Was the complainant’s personal information protected by the Municipality, 
‘cin compliance with the Act? 

As previously mentioned, as well as being an employee, the complainant was also a tenant of 

the Municipality’s housing corporation. The complainant stated that certain documents relating 

to her employment with the Municipality were delivered to her in an unsecured fashion, -in 

contravention Mh ng Act. 


Sections 3(1) antl (Ovot Regulation 823 under the Act state: 


(1) Every head shall ensure that reasonable measures to prevent unauthorized 
access tothe records in his or her institution are defined, documented and 
put in place, taking into account the nature of the records to be protected. 


(2) Every head shall ensure that only those individuals who need a record for 
the Done Ne of their duties shall have access to At. 
Letters of March 9, June 29 and ipte 14, 1994 ‘ bs 
The complainant stated that the original copies of the aforementioned letter of March 9th and 
her letter of termination, dated July 14, 1994, were. initially, given to fer Superintendent by her 
Manager. The complaingnt added that:she had subsequently. found these letters taped to the door 
of her unit in unsealed envelopes. The complainant was concerned that anyone in the building 
could have read these letters. 4 
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The Municipality submitted that, to the best recollection of the Manager, the original copies of 
the letter of March 9th and the termination letter of July 14th were in sealed envelopes, hand 
delivered by the Superintendent. The. Municipality added that, according to the Superintendent, 
the letters were not taped to the door of the complainant’s unit, but were pushed under her 
apartment door. ; ee eye 
The complainant later clarified that the March 9th letter was in fact pushed under her apartment 
door, but in an unsealed versus sealed envelope. She further clarified that it was a letter dated 
June 29, 1994, relating to her suspension, that had been taped to her door in an unsealed 
envelope, instead of the March 9th letter. 

Given the differing accounts of how these letters were delivered to the complainant, we are not 
able to make a conclusive finding as to whether the complainant’s personal information was 
protected in compliance with the Act, with regard to these letters. 
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Pension Statement : 

The complainant stated that on January 19, 1994, her then Superintendent’ handed’ her a‘large 
envelope -- the type used for repeat delivery of interdepartmental correspondence. The 
complainant explained that the envelope contained her confidential 1992 OMERS pension 
statement, which included her age, social insurance number. and pension ‘information. The 
complainant questioned why a confidential document would be delivered to her in this unsecured 
fashion, when, on the contrary, she had observed the Superintendent and the Assistant 
Superintendent open their pension statements which were delivered in sealed OMERS envelopes. 
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The Municipality submitted that no pension material was sent to staff of the housing. corporation 
on January 19, 1994. It added that the 1992 pension statements were distributed to staff in late 
December 1993 or early January 1994, in sealed OMERS envelopes. 


The Municipality also stated that, at the complainant’s request, OMERS revised the beneficiary 
information on the complainant’s 1992 statement. The Municipality added that neither its own 
employee, who administered OMERS internally, nor the OMERS employee who had revised the 
complainant’s statement, could recall if the revised statement had been sent to the housing 
corporation “in an individual OMERS envelope or if both copies were sent to the employer in 
a manila envelope." The Municipality further stated that, on April 11, 1994, a revised statement 
and a covering memo were placed in a sealed manila envelope, stamped "Confidential" and 
mailed directly to the complainant’s home address. 


The cofiiplainant subsequently clarified that she had received her 1992 OMERS statement on 
February 24, 1994, not January 19, 1994. 


Given the differing accounts of how the complainant’s 1992 pension statement was delivered to 
the complainant, we are not able to make a conclusive finding as to whether the complainant’s 
personal information was protected in compliance with the Act, in this regard. 


Coriéliision Our findings ‘are inconclusive as to whether the complainant’s personal 
information was protectéd by the Municipality, in compliance with the 


SUMMARY OF CONCLUSIONS 


e The information in question was "personal information" as defined in section 2(1) of the 
e The Municipality’s proposed collection of the complainant’s personal information would 


have been in compliance with section 28(2) of the Act. 


2 The complainant’s personal information was disclosed to the EIC, in compliance with 
section 32 of the Act. 


® Qur findings are inconclusive as to whether the complainant’s personal information was 
protected by the Municipality, in compliance with the Act. 


(iisittal Signed By: August 31, 1995 
Susan Anthistle Date 


Compliance Review Officer 
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